CVE-2025-7006
Use of stack memory after free vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25022500. The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.5
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS probability
- 0.11%
- CWE
- CWE-590
- Published
- 2026-06-12
- Last modified
- 2026-06-15
Affected products
- Gen Digital Avast Antivirus
- Gen Digital AVG Antivirus
- Gen Digital Norton Antivirus
- Gen Digital Avast One
- Gen Digital Avast Business Antivirus
Weakness type
Related vulnerabilities
- CVE-2026-89161 — In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a...
- CVE-2026-18582 — mz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heap
- CVE-2026-47328 — Invalid pointer deallocation in Ubuntu Linux AppArmor notification handling
- CVE-2026-20810 — Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2025-54899 — Microsoft Excel Remote Code Execution Vulnerability
- CVE-2025-42996 — Multiple vulnerabilities in SAP MDM Server
- CVE-2025-42995 — Multiple vulnerabilities in SAP MDM Server
- CVE-2025-42994 — Multiple vulnerabilities in SAP MDM Server