CVE-2025-4134CWE-552

Lack of file validation in Avast Business Antivirus for Linux allows writing untrusted update files

High · published May 28, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

Lack of file validation in do_update_vps in Avast Business Antivirus for Linux 4.5 on Linux allows local user to spoof or tamper with the update file via an unverified file write.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.6th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2025-05-28T13:53Z
EPSS history
Timeline
  • 28 MAY 13:53Z
    Lack of file validation in Avast Business Antivirus for Linux allows writing untrusted update files
    cvelistv5