# CVE-2025-7019: Gen Digital Antivirus stack overflow in Office Open XML scanning

Source: https://junglewise.ai/threats/cve-2025-7019-gen-digital-antivirus-stack-overflow-in-office-open-xml-scanning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2025-7019 · Severity: medium · CVSS 5.5 · Published 2026-06-12

A vulnerability in several popular antivirus products, including Avast, AVG, and Norton, could allow a malicious file to crash the security software. By tricking a user into opening or downloading a specially crafted Office document, an attacker can cause the antivirus engine to stop functioning. This results in a denial-of-service, leaving the system temporarily unprotected against other threats.

Technologies: [Avast Business Antivirus](https://junglewise.ai/threats/technologies/business-antivirus), [Avast One](https://junglewise.ai/threats/technologies/one). Vendors: [Avast](https://junglewise.ai/threats/vendors/avast).

## Quick answers

**Is CVE-2025-7019 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-7019 being exploited in the wild.

**How severe is CVE-2025-7019?** Medium severity, with a CVSS score of 5.5, published 12 June 2026.

**Which products and versions are affected?** Avast Business Antivirus Virus definition builds before VPS 25020100; Avast One Virus definition builds before VPS 25020100.

**Is there a fix for CVE-2025-7019?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-7019 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2025-7019?** Check whether you run Avast Business Antivirus or Avast One at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the shared Gen Digital scanning logic used across multiple antivirus brands. The vulnerability is triggered when the engine attempts to parse a malformed Office Open XML (.docx, .xlsx, etc.) file. An attacker can exploit this by providing a specially crafted file that, when scanned, causes the antivirus process to crash (Denial-of-Service). The attack requires local access or user interaction (e.g., downloading the file). The fix is delivered via the virus definition update stream; systems are protected once they reach VPS build 25020100 or higher.

## Affected products

- Gen Digital Avast Antivirus Virus definition builds before VPS 25020100
- Gen Digital AVG Antivirus Virus definition builds before VPS 25020100
- Gen Digital Norton Antivirus Virus definition builds before VPS 25020100
- Gen Digital Avast One Virus definition builds before VPS 25020100
- Gen Digital Avast Business Antivirus Virus definition builds before VPS 25020100

## Timeline

- 2026-06-12: disclosed
- 2026-06-12: advisory

## References

- [https://www.gendigital.com/us/en/contact-us/security-advisories/](https://www.gendigital.com/us/en/contact-us/security-advisories/)

## Related threats

- [Gen Digital Antivirus stack memory after free in PE scanning engine](https://junglewise.ai/threats/cve-2025-7006-gen-digital-antivirus-stack-memory-after-free-in-pe-scanning)
- [Gen Digital Antivirus uncontrolled recursion in PE file scanning](https://junglewise.ai/threats/cve-2025-7005-gen-digital-antivirus-uncontrolled-recursion-in-pe-file-scanning)
- [Gen Digital Antivirus heap out-of-bounds read in Mach-O scanning](https://junglewise.ai/threats/cve-2025-10101-gen-digital-antivirus-heap-out-of-bounds-read-in-mach-o-scanning)