CVE-2025-14098: Avira Antivirus Engine RCE Vulnerability

CVE-2025-14098 Overview

CVE-2025-14098 is a heap buffer out-of-bounds write vulnerability in the Avira Antivirus engine. The flaw originates from an integer overflow [CWE-190] triggered when the engine scans a malformed MS-DOS executable file. Successful exploitation can lead to local code execution within the antivirus engine process or denial-of-service of the scanner.

The issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds prior to 8.3.70.104. Because antivirus engines often run with elevated privileges and automatically process files placed on disk, an attacker who can stage a crafted file on the target system can reach the vulnerable scan path.

Critical Impact
An attacker who lands a malformed MS-DOS executable on a system can trigger heap corruption in the antivirus engine, enabling local code execution or shutting down on-access protection.

Affected Products

Avira Antivirus for Windows (engine builds before 8.3.70.104)
Avira Antivirus for macOS (engine builds before 8.3.70.104)
Avira Antivirus for Linux (engine builds before 8.3.70.104)

Discovery Timeline

2026-06-12 - CVE-2025-14098 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14098

Vulnerability Analysis

The vulnerability resides in the file parser used by the Avira Antivirus engine to process MS-DOS executable (MZ) files. When the engine parses header fields from a malformed MS-DOS binary, a size or offset calculation overflows an integer variable. The truncated result is then used to allocate or index a heap buffer that is smaller than the data the parser proceeds to write.

The resulting out-of-bounds write corrupts adjacent heap memory inside the scanner process. Depending on the heap layout, an attacker can either crash the engine (denial-of-service) or steer the corruption toward function pointers, vtables, or object metadata to achieve local code execution in the engine context.

Because the antivirus engine typically scans every new file written to disk, the attacker does not need to convince a user to open the file. Dropping the malformed sample into a watched directory is sufficient for the scanner to consume it.

Root Cause

The root cause is an integer overflow [CWE-190] in a length or offset computation derived from attacker-controlled fields of the MS-DOS executable header. The undersized allocation that follows the overflow allows a subsequent copy or write operation to exceed the heap buffer boundary.

Attack Vector

The attack vector is local. An attacker must place a crafted MS-DOS executable on the target system through any channel that triggers a scan, such as a download, email attachment, USB drop, or shared folder write. User interaction is required only in the sense that the file must arrive on disk; on-access scanning then invokes the vulnerable code path automatically.

No working public exploit or proof-of-concept has been published for CVE-2025-14098 at the time of writing. Technical details are described in the Gen Digital Security Advisory.

Detection Methods for CVE-2025-14098

Indicators of Compromise

Unexpected crashes, restarts, or hangs of the Avira engine process on Windows, macOS, or Linux endpoints.
Avira engine versions reporting a build number lower than 8.3.70.104 in product telemetry.
Appearance of unknown MS-DOS executable (MZ) files in user-writable or network-shared directories shortly before scanner faults.

Detection Strategies

Inventory Avira engine build numbers across the fleet and alert on any host running an engine older than 8.3.70.104.
Monitor operating system crash logs (Windows Application event log, macOS ReportCrash, Linux coredump) for faults in Avira scanner binaries.
Correlate antivirus engine crashes with recent file writes to identify potentially malicious MS-DOS samples that triggered the fault.

Monitoring Recommendations

Forward antivirus process telemetry and crash events into a centralized SIEM or data lake for cross-host correlation.
Track scanner uptime and exit codes to detect repeated denial-of-service patterns against the engine.
Retain suspicious MZ samples that coincide with engine faults for offline analysis.

How to Mitigate CVE-2025-14098

Immediate Actions Required

Update the Avira Antivirus engine to build 8.3.70.104 or later on all Windows, macOS, and Linux endpoints.
Verify that automatic engine updates are enabled and that endpoints have successfully pulled the fixed build.
Restrict write access to directories monitored by the on-access scanner where untrusted users can drop files.

Patch Information

Gen Digital has released a fixed Avira Antivirus engine build 8.3.70.104 that addresses the integer overflow in the MS-DOS executable parser. Refer to the Gen Digital Security Advisory for distribution channels and confirmation of the updated engine version on each supported platform.

Workarounds

If patching is delayed, disable on-access scanning for untrusted directories until the engine can be updated.
Block ingestion of MS-DOS executables from untrusted sources at the email gateway and web proxy.
Limit interactive logon and file-write privileges on systems running vulnerable Avira builds to reduce the local attack surface.

bash

# Verify the installed Avira engine build on Linux
/opt/Avira/avupdate --info | grep -i "Engine version"

# Expected output on patched systems:
# Engine version: 8.3.70.104 (or later)