CVE-2025-14098
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A heap buffer out-of-bounds write vulnerability due to integer overflow was discovered in the Avira Antivirus engine when scanning a malformed MS-DOS executable file. This could allow local execution of code or denial-of-service of the antivirus engine process. Affects engine builds before 8.3.70.104 on Windows, macOS, and Linux.
Risk Assessment
A local attacker could exploit this vulnerability to execute arbitrary code in the context of the antivirus process or cause it to crash, weakening system protection.
Recommendation
It is recommended to update the Avira Antivirus engine to version 8.3.70.104 or later.
Other vulnerabilities in Avira Antivirus
See all- CVE-2026-6676High
A heap buffer out-of-bounds write vulnerability was discovered in the Avira Antivirus engine when scanning a malformed POSIX tar archive. This could allow local execution of code or denial-of-service of the antivirus engine process. Affects engine builds before 8.3.27.12 on Windows, macOS, and Linux.
- CVE-2025-9033High
A heap buffer out-of-bounds read vulnerability was discovered in the Avira Antivirus engine when scanning a malformed PDF file. This could allow local execution of code or denial-of-service of the antivirus engine process. Affects engine builds before 8.3.70.76 on Windows, macOS, and Linux.
- CVE-2025-9032High
A heap buffer out-of-bounds read vulnerability was discovered in the Avira Antivirus engine when scanning a malformed Windows PE file. This could allow local execution of code or denial-of-service of the antivirus engine process. Affects engine builds before 8.3.70.98 on Windows, macOS, and Linux.
Original NVD description (English source)
Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.104.