The vulnerability is a use‑after‑free in the scanning logic of the Gen Digital engine when processing a malformed Windows PE file. Exploit of this flaw can cause the antivirus process to crash, resulting in a denial‑of‑service condition for the user or system. The weakness is a classic Use After Free, categorized as CWE‑590. No information is provided that the crash could lead to code execution or data exfiltration.

AV products built on the Gen Digital virus‑definition update stream—including Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast Business Antivirus, and Avast One—are affected on Windows, macOS, and Linux. Any build that predates the virus‑definition build VPS 25022500 uses the vulnerable scanning logic and therefore is susceptible.

The CVSS score of 5.5 reflects a moderate severity that mainly disrupts availability. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred to be a locally or remotely delivered malformed PE file sent to the scanner; the description does not explicitly state network or privilege requirements, so the assumption is that delivery to the scan engine is necessary for exploitation. Due to the moderate CVSS, the risk is moderate; however, continuous scanning of unknown files is common, making the DoS impact potentially frequent if the update is not applied.