The vulnerability is a heap buffer out‑of‑bounds read that occurs when Avast and related Gen Digital antivirus products try to scan a malformed Windows PE file. The read can be exploited to execute code locally or to crash the antivirus process, resulting in a denial of service. The weakness corresponds to CWE‑125.

The affected products are Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus running on Windows, macOS, and Linux. Only virus‑definition builds earlier than VPS 25021310 are vulnerable; all builds at or above that stream are safe.

The CVSS score of 7.8 indicates moderate to high severity, but EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local attacker who can place a crafted PE file on a system that will be scanned by the compromised antivirus. An exploit would require the victim to be running the affected product and to load the malicious file during a scan. Because the weakness is read‑only, the consequence is limited to code execution or a process crash, not a full system compromise.