Uncontrolled recursion in Avast Antivirus when scanning a malformed PE file causes the antivirus process to consume excessive stack resources, leading to a denial‑of‑service. The flaw is a classic CWE‑674 recursion bug. An attacker can trigger the DoS by offering a specially crafted Windows PE file for the product to analyze.

The vulnerability affects all Gen Digital products that consume the same virus‑definition stream – Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus – on Windows, macOS, and Linux. Only builds before the virus‑definition update VPS 25031700 are vulnerable; later builds are not affected. The flaw exists in the shared scanning logic delivered via the common definition stream.

With a CVSS score of 5.5 the risk is moderate. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack scenario is local – an attacker would need to supply the malformed PE file to the machine, so it cannot be exploited remotely without additional foothold. Once the file is processed the antivirus process terminates, but system functionality remains otherwise intact.