CVE-2025-14098
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in the Avira Antivirus engine allows for a heap buffer out-of-bounds write due to integer overflow, which may lead to Local Execution of Code or Denial-of-Service of the antivirus engine process when scanning a malformed MS-DOS executable file.
Risk Assessment
The organization may be exposed to local execution of malicious code or disruptions in the antivirus engine's operation, potentially leading to data loss or system security breaches.
Recommendation
It is recommended to update the Avira Antivirus engine to version 8.3.70.104 or later to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.104.