CVE-2025-7007CWE-476

CVE-2025-7007

High · published December 1, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
1.2
In the wild
Unconfirmed
What it is

⚡ A funky NULL Pointer Dereference in Avast Antivirus could send your software crashing like a party without a DJ! 🎉 Think of your antivirus as a bouncer at a nightclub. If it encounters a malformed Windows PE file, it's like trying to check an ID that doesn't exist at all — resulting in total confusion and a complete shutdown of the party! This vulnerability could lead to the antivirus process crashing during scans, leaving your device unprotected and at risk. An attacker exploiting this bug could potentially maneuver around defenses while you’re left in the dark. Don’t let your guard down!

Put simply

Think of your antivirus as a bouncer at a nightclub. If it encounters a malformed Windows PE file, it's like trying to check an ID that doesn't exist at all — resulting in total confusion and a complete shutdown of the party! The vulnerability arises when scanning a malformed Windows PE file, causing the antivirus to reference a NULL pointer, leading to a crash. Affected versions include Avast Antivirus 16.0.0 and 3.0.3 on MacOS and Linux, respectively.

What to do

This vulnerability could lead to the antivirus process crashing during scans, leaving your device unprotected and at risk. An attacker exploiting this bug could potentially maneuver around defenses while you’re left in the dark. Don’t let your guard down! To address this, ensure you update your Avast Antivirus to the latest version available. Regularly check for updates and consider employing additional security measures to complement your antivirus. Don’t wait until it’s too late! You’ve got this! Stay vigilant, patch up, and keep your defenses strong! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00110 · 1.2th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-12-01T22:15Z
References (1)
EPSS history
Timeline
  • 01 DEC 16:34Z
    Null pointer dereference in Avast Antivirus on macOS (16.0.0) or Linux (3.0.3)
    cvelistv5