Skip to content
Connect AISign inSign up free
CVE-2025-70117.8HighCWE-125

CVE-2025-7011: Avast antivirus heap OOB when scanning a malformed zip file

Gen Digital · Avast Antivirus

Vendor fix available · Affected: Gen Digital Avast Antivirus · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.1%probability of exploitation in the next 30 days
3rd percentile
050100

Higher than 3% of scored CVEs

7.8HighCVSS 3.1
LowHigh

DescriptionCVE.org

Heap out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed zip file containing XML may allow Local Execution of Code or Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds from 25020100 before 25021208. The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.

Affected products5

From the CVE record. A product or version that is not listed is unknown, not unaffected.

  • Gen Digital · Avast Antivirusfrom 25020100 before 25021208
  • Gen Digital · AVG Antivirusfrom 25020100 before 25021208
  • Gen Digital · Norton Antivirusfrom 25020100 before 25021208
  • Gen Digital · Avast Onefrom 25020100 before 25021208
  • Gen Digital · Avast Business Antivirusfrom 25020100 before 25021208

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas
Exploitation
Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV
Not listed
Public check
No public nuclei template
Published
June 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2025-7011 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.

References