A stack overflow caused by uncontrolled recursion in Avast’s PDF scanning logic can crash the antivirus process, resulting in a denial‑of‑service condition. The flaw is a classic stack overflow (CWE‑674) that does not provide remote code execution, but terminates the security product and can hinder system protection.

The vulnerability affects Gen Digital products that rely on the shared virus‑definition update stream, including AVG Antivirus, Avast Antivirus, Avast Business Antivirus, Avast One, and Norton Antivirus. It applies to Windows, macOS, and Linux installations that use virus‑definition builds earlier than VPS 25021208. All builds at or above VPS 25021208 are immune, regardless of the consuming product.

The CVSS score of 5.5 indicates moderate severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a malformed PDF file that is scanned by the antivirus, either locally or during automated content inspection. Exploitation would require the victim to trigger a scan of the crafted PDF; no remote exploitation path is documented.