# CVE-2025-7006: Gen Digital Antivirus stack memory after free in PE scanning engine

Source: https://junglewise.ai/threats/cve-2025-7006-gen-digital-antivirus-stack-memory-after-free-in-pe-scanning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2025-7006 · Severity: medium · CVSS 5.5 · Published 2026-06-12

A vulnerability exists in several popular antivirus products, including Avast, AVG, and Norton, which are used to protect computers from malware. If a user attempts to scan a specially crafted, malicious file, the antivirus software may crash and stop functioning. This results in a denial-of-service, leaving the system temporarily unprotected until the antivirus process is restarted.

Technologies: [Avast Business Antivirus](https://junglewise.ai/threats/technologies/business-antivirus), [Avast One](https://junglewise.ai/threats/technologies/one). Vendors: [Avast](https://junglewise.ai/threats/vendors/avast).

## Quick answers

**Is CVE-2025-7006 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-7006 being exploited in the wild.

**How severe is CVE-2025-7006?** Medium severity, with a CVSS score of 5.5, published 12 June 2026.

**Which products and versions are affected?** Avast Business Antivirus Virus definition builds before VPS 25022500; Avast One Virus definition builds before VPS 25022500.

**Is there a fix for CVE-2025-7006?** A patch was published on 2025-02-25: Date inferred from VPS version string 25022500 (Feb 25, 2025) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-7006 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2025-7006?** Check whether you run Avast Business Antivirus or Avast One at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A 'Free of Memory not on the Heap' (CWE-590) vulnerability exists in the shared scanning logic used by Avast, AVG, and Norton antivirus products. The flaw is triggered when the engine attempts to scan a malformed Windows Portable Executable (PE) file, leading to a use-after-free condition involving stack memory. An attacker can exploit this by providing a crafted file to be scanned, causing the antivirus process to crash (Denial-of-Service). The vulnerability is local in nature but requires user interaction (e.g., downloading or opening a folder containing the file). The issue is resolved in virus definition builds VPS 25022500 and later.

## Affected products

- Gen Digital (Avast) Avast Antivirus Virus definition builds before VPS 25022500
- Gen Digital (AVG) AVG Antivirus Virus definition builds before VPS 25022500
- Gen Digital (Norton) Norton Antivirus Virus definition builds before VPS 25022500
- Gen Digital (Avast) Avast One Virus definition builds before VPS 25022500
- Gen Digital (Avast) Avast Business Antivirus Virus definition builds before VPS 25022500

## Timeline

- 2026-06-12: disclosed
- 2025-02-25: patched: Date inferred from VPS version string 25022500 (Feb 25, 2025)

## References

- [https://www.gendigital.com/us/en/contact-us/security-advisories/](https://www.gendigital.com/us/en/contact-us/security-advisories/)

## Related threats

- [Gen Digital Antivirus stack overflow in Office Open XML scanning](https://junglewise.ai/threats/cve-2025-7019-gen-digital-antivirus-stack-overflow-in-office-open-xml-scanning)
- [Gen Digital Antivirus uncontrolled recursion in PE file scanning](https://junglewise.ai/threats/cve-2025-7005-gen-digital-antivirus-uncontrolled-recursion-in-pe-file-scanning)
- [Gen Digital Antivirus heap out-of-bounds read in Mach-O scanning](https://junglewise.ai/threats/cve-2025-10101-gen-digital-antivirus-heap-out-of-bounds-read-in-mach-o-scanning)