CVE-2025-7011: Gen Digital Antivirus heap out-of-bounds read in ZIP scanning engine

CVE-2025-7011 · Severity: high · CVSS 7.8 · Published 2026-06-12

A vulnerability exists in several popular antivirus products, including Avast, AVG, and Norton, which are used to protect computers from malware. If a user is tricked into opening or scanning a specially crafted ZIP file, the antivirus software could crash or potentially allow an attacker to run unauthorized code on the system. This issue affects users on Windows, macOS, and Linux who have not updated their virus definitions recently.

Technologies: Gen Digital Avast Antivirus, Gen Digital Avast Business Antivirus, Gen Digital Avast One, Gen Digital AVG Antivirus, Gen Digital Norton Antivirus. Vendors: Gen Digital.

Quick answers

Is CVE-2025-7011 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-7011 being exploited in the wild.
How severe is CVE-2025-7011?
High severity, with a CVSS score of 7.8, published 12 June 2026.
Which products and versions are affected?
Gen Digital Avast Antivirus virus definition builds from 25020100 before 25021208; Gen Digital Avast Business Antivirus virus definition builds from 25020100 before 25021208; Gen Digital Avast One virus definition builds from 25020100 before 25021208; Gen Digital AVG Antivirus virus definition builds from 25020100 before 25021208; and 1 more.
Is there a fix for CVE-2025-7011?
A patch was published on 2025-02-12: Fixed in virus definition build 25021208 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-7011 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-7011?
Check whether you run Gen Digital Avast Antivirus, Gen Digital Avast Business Antivirus, Gen Digital Avast One or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap out-of-bounds read vulnerability (CWE-125) exists in the scanning logic shared across multiple Gen Digital antivirus products. The flaw is triggered when the engine scans a malformed ZIP file containing specific XML content. While the attack vector is local, it requires no special privileges (PR:N) but does require user interaction (UI:R), such as a user downloading or attempting to scan the malicious archive. Successful exploitation can lead to a denial-of-service (crashing the antivirus process) or potentially arbitrary code execution. The vulnerability was introduced in virus definition build 25020100 and is resolved in build 25021208 or later.

Affected products

  • Gen Digital Avast Antivirus virus definition builds from 25020100 before 25021208
  • Gen Digital AVG Antivirus virus definition builds from 25020100 before 25021208
  • Gen Digital Norton Antivirus virus definition builds from 25020100 before 25021208
  • Gen Digital Avast One virus definition builds from 25020100 before 25021208
  • Gen Digital Avast Business Antivirus virus definition builds from 25020100 before 25021208

Timeline

  • 2026-06-12: disclosed: NVD publication date
  • 2025-02-12: patched: Fixed in virus definition build 25021208

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.