CVE-2025-10101— Avast antivirus heap buffer OOB read when scanning a malformed Mach-O file
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client ExecutionAffected Version Matrix 5
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Gen Digital | Avast Antivirus | < 25090300 | affected |
| Gen Digital | Avast Business Antivirus | < 25090300 | affected |
| Gen Digital | Avast One | < 25090300 | affected |
| Gen Digital | AVG Antivirus | < 25090300 | affected |
| Gen Digital | Norton Antivirus | < 25090300 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-10101
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Avast antivirus heap buffer OOB read when scanning a malformed Mach-O file
Source: NVD (National Vulnerability Database)
Vulnerability Description
Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Mach-O file may allow Local Execution of Code or Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25090300. The affected scanning logic is delivered through a shared Gen Digital virus definition update stream. The same stream feeds the consumer antivirus products listed in this advisory and other Gen Digital products that embed the same engine. Mitigation flows through this update channel; installations at or above the listed build are not vulnerable regardless of which product consumes the stream.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨界内存读
Source: NVD (National Vulnerability Database)
Vulnerability Title
Avast Antivirus 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Avast Antivirus是捷克Avast公司的一套杀毒软件。 Avast Antivirus 15.7版本至3.9.2025之前版本存在安全漏洞，该漏洞源于堆缓冲区溢出和越界写入，可能导致本地代码执行或拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Gen Digital | Avast Antivirus | 0 ~ 25090300 | - | |
| Gen Digital | AVG Antivirus | 0 ~ 25090300 | - | |
| Gen Digital | Norton Antivirus | 0 ~ 25090300 | - | |
| Gen Digital | Avast One | 0 ~ 25090300 | - | |
| Gen Digital | Avast Business Antivirus | 0 ~ 25090300 | - |
II. Public POCs for CVE-2025-10101
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-10101
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Avast Antivirus
- CVE-2025-71326
AVAST Antivirus 25.11 Unquoted Service Path Privilege Escala - CVE-2025-7019
Avast antivirus stack overflow when scanning a malformed Off - CVE-2025-7011
Avast antivirus heap OOB when scanning a malformed zip file - CVE-2025-7010
Avast antivirus stack overflow when scanning a malformed PDF - CVE-2025-7009
Avast antivirus heap buffer OOB read when scanning a malform
Same vendor: Gen Digital
- CVE-2026-12068
Avira Password Manager credential disclosure via cross-origi - CVE-2026-6676
Avira antivirus engine heap buffer OOB write when scanning a - CVE-2025-14098
Avira antivirus engine heap buffer OOB write when scanning a - CVE-2025-9033
Avira antivirus engine heap buffer OOB read when scanning a - CVE-2025-9032
Avira antivirus engine heap buffer OOB read when scanning a
Same weakness: CWE-125
- CVE-2026-54341
Dragonfly: RESTORE operations may crash the server - CVE-2026-12340
Out-of-bounds heap read in SM2/SM3 certificate Subject Key I - CVE-2026-56788
RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index i - CVE-2026-12897
Out-of-bounds read in Horner Automation Cscape - CVE-2026-6094
Heap buffer overread in wc_PKCS7_DecodeEnvelopedData parsing
V. Comments for CVE-2025-10101
No comments yet