Out-of-bounds read vulnerability in Avira Antivirus engine occurs when parsing a malformed PDF, allowing a local user to trigger code execution or crash the scanning process, which can lead to denial of service. The flaw is a buffer over-read, classified as CWE-125.

Affected systems include all versions of Gen Digital’s Avira Antivirus running on Windows, macOS, or Linux with engine builds older than 8.3.70.76. Builds 8.3.70.76 and later contain the fix.

The CVSS score of 7.8 indicates high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. The likely attack vector is local, requiring an attacker to deliver a malicious PDF to a victim machine—such as via phishing or social engineering—then trigger the vulnerable scanning routine. Because the flaw is triggered during file parsing, remote exploitation without local access is not feasible.