A heap buffer out-of-bounds write in the Avira Antivirus engine occurs when scanning a malformed POSIX tar archive. The flaw, classified as CWE‑787, can allow a locally privileged user to trigger a code execution or cause a denial‑of‑service by crashing the antivirus process during scanning.

All versions of Avira Antivirus for Windows, macOS, and Linux with engine builds older than 8.3.27.12 are impacted; newer builds contain the fix.

The CVSS score of 7.8 signifies high severity, but the EPSS score is not available, so the probability of exploitation is uncertain. The vulnerability is not listed in CISA KEV. Exploitation requires local access to a system running the affected engine and the ability to initiate scanning of a crafted tar file, either manually by a user or by a program that triggers antivirus scans. The lack of remote access limitations reduces the scope of impact compared to high‑risk remote exploitation, yet local code execution or denial-of-service remains a serious threat to users who run the affected antivirus build.