A heap buffer out‑of‑bounds read vulnerability exists in the Avira Antivirus engine when scanning malformed PDF files. The flaw allows an attacker to read data beyond the intended bounds of a heap buffer, potentially enabling local execution of arbitrary code or causing the antivirus engine process to crash, resulting in denial of service. The weakness is classified as CWE‑125, indicating an out‑of‑bounds read.

The vulnerability affects Gen Digital’s Avira Antivirus on Windows, macOS, and Linux. All builds of the scan engine released before build 8.3.70.56 are susceptible; newer builds contain the fix.

The CVSS score of 7.8 indicates a high severity impact. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation data. The likely attack vector is local: an adversary would need to supply a specially crafted PDF to the Avira engine, for example by opening or otherwise scanning the file on a compromised machine. Once the malformed PDF is processed, the out‑of‑bounds read could be leveraged by a local attacker to inject or execute code, or simply to crash the engine, disrupting its operation.