Is CVE-2025-7019 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-7019 being exploited in the wild.

How severe is CVE-2025-7019?

Medium severity, with a CVSS score of 5.5, published 12 June 2026.

Which products and versions are affected?

Avast Business Antivirus Virus definition builds before VPS 25020100; Avast One Virus definition builds before VPS 25020100.

Is there a fix for CVE-2025-7019?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-7019 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2025-7019?

Check whether you run Avast Business Antivirus or Avast One at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-7019: Gen Digital Antivirus stack overflow in Office Open XML scanning

CVE-2025-7019 · Severity: medium · CVSS 5.5 · Published 2026-06-12

A vulnerability in several popular antivirus products, including Avast, AVG, and Norton, could allow a malicious file to crash the security software. By tricking a user into opening or downloading a specially crafted Office document, an attacker can cause the antivirus engine to stop functioning. This results in a denial-of-service, leaving the system temporarily unprotected against other threats.

Technologies: Avast Business Antivirus, Avast One. Vendors: Avast.

Quick answers

Is CVE-2025-7019 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-7019 being exploited in the wild.
How severe is CVE-2025-7019?: Medium severity, with a CVSS score of 5.5, published 12 June 2026.
Which products and versions are affected?: Avast Business Antivirus Virus definition builds before VPS 25020100; Avast One Virus definition builds before VPS 25020100.
Is there a fix for CVE-2025-7019?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-7019 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-7019?: Check whether you run Avast Business Antivirus or Avast One at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-121) exists in the shared Gen Digital scanning logic used across multiple antivirus brands. The vulnerability is triggered when the engine attempts to parse a malformed Office Open XML (.docx, .xlsx, etc.) file. An attacker can exploit this by providing a specially crafted file that, when scanned, causes the antivirus process to crash (Denial-of-Service). The attack requires local access or user interaction (e.g., downloading the file). The fix is delivered via the virus definition update stream; systems are protected once they reach VPS build 25020100 or higher.

Affected products

Gen Digital Avast Antivirus Virus definition builds before VPS 25020100
Gen Digital AVG Antivirus Virus definition builds before VPS 25020100
Gen Digital Norton Antivirus Virus definition builds before VPS 25020100
Gen Digital Avast One Virus definition builds before VPS 25020100
Gen Digital Avast Business Antivirus Virus definition builds before VPS 25020100

Timeline

2026-06-12: disclosed
2026-06-12: advisory

References

https://www.gendigital.com/us/en/contact-us/security-advisories/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.