CVE-2025-7009: Gen Digital Antivirus out-of-bounds read in PE file scanning

CVE-2025-7009 · Severity: high · CVSS 7.8 · Published 2026-06-12

A vulnerability exists in several popular antivirus products, including Avast, AVG, and Norton, which are used to protect computers from malware. If a user attempts to scan a specially crafted, malicious Windows file, the antivirus software could crash or allow an attacker to run unauthorized code on the system. This could lead to a complete compromise of the device or a disruption of security services.

Technologies: Gen Digital Avast Antivirus, Gen Digital Avast Business Antivirus, Gen Digital Avast One, Gen Digital AVG Antivirus, Gen Digital Norton Antivirus. Vendors: Gen Digital.

Quick answers

Is CVE-2025-7009 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-7009 being exploited in the wild.
How severe is CVE-2025-7009?
High severity, with a CVSS score of 7.8, published 12 June 2026.
Which products and versions are affected?
Gen Digital Avast Antivirus before VPS 25021310; Gen Digital Avast Business Antivirus before VPS 25021310; Gen Digital Avast One before VPS 25021310; Gen Digital AVG Antivirus before VPS 25021310; and 1 more.
Is there a fix for CVE-2025-7009?
A patch was published on 2025-02-13: Fix released in VPS build 25021310 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-7009 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-7009?
Check whether you run Gen Digital Avast Antivirus, Gen Digital Avast Business Antivirus, Gen Digital Avast One or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap buffer out-of-bounds read (CWE-125) exists in the shared scanning logic of Gen Digital antivirus products. The vulnerability is triggered when the engine processes a malformed Windows Portable Executable (PE) file. While the attack vector is classified as local, it requires user interaction (UI:R), such as a user or a scheduled task initiating a scan of the malicious file. Successful exploitation can lead to a denial-of-service (DoS) of the antivirus process or potentially arbitrary code execution. The flaw resides in the virus definition update stream (VPS) rather than the main application binaries. A fix has been released via the shared update channel; all installations with virus definition build VPS 25021310 or later are protected.

Affected products

  • Gen Digital Avast Antivirus before VPS 25021310
  • Gen Digital AVG Antivirus before VPS 25021310
  • Gen Digital Norton Antivirus before VPS 25021310
  • Gen Digital Avast One before VPS 25021310
  • Gen Digital Avast Business Antivirus before VPS 25021310

Timeline

  • 2026-06-12: disclosed
  • 2026-06-12: advisory
  • 2025-02-13: patched: Fix released in VPS build 25021310

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.