Introduction
A single malformed file can disable or compromise the antivirus engine that is meant to protect a macOS system. Security teams running Avast Antivirus for macOS versions 8.3.70.94 up to but not including 8.3.70.98 are exposed to CVE-2025-8351, a critical heap-based buffer overflow and out-of-bounds read vulnerability. It lets a local attacker execute code or crash the antivirus process while it scans a file.
About Avast and Gen Digital: Avast is a core brand within Gen Digital, a global cybersecurity conglomerate with over 500 million users in more than 150 countries. Avast's antivirus products are widely deployed in consumer and enterprise environments, so a vulnerability in its software has a wide impact across the industry.
Technical Information
CVE-2025-8351 comes from improper memory management in the Avast Antivirus scanning engine for macOS. When the engine scans a specially crafted malformed file, it allocates a buffer on the heap to process the file data. The engine does not sufficiently validate the length of the incoming data before it writes that data into the buffer. Two distinct issues follow:
-
Heap-based buffer overflow (CWE-122): Data written past the allocated buffer boundary can corrupt adjacent memory and may overwrite critical structures or function pointers. An attacker can use this to execute arbitrary code in the context of the antivirus process, or to crash the process.
-
Out-of-bounds read (CWE-125): The engine may also read data outside the intended buffer, which can disclose information or further destabilize the process.
The attack vector is local, so an attacker must first deliver a malformed file to the target system. The vulnerability triggers when Avast scans that file, whether in a real-time, on-demand, or scheduled scan. No public code snippets or proof-of-concept details are available as of this writing.
Affected Systems and Versions
- Product: Avast Antivirus for macOS
- Affected versions: 8.3.70.94 up to but not including 8.3.70.98
- Vulnerable component: Core scanning engine (file parsing during scan operations)
- Scope: All macOS configurations running an affected version are vulnerable
Vendor Security History
Avast, now part of Gen Digital, has fixed several security issues in its antivirus products before. Notable examples include:
- CVE-2017-8308: Privilege escalation in Avast Antivirus
- CVE-2024-9484: Null-pointer dereference in Avast/AVG for macOS
- CVE-2024-9481: Other memory safety issues in Avast/AVG
The vendor runs a public security advisory process and has a track record of releasing patches for critical issues. Its business products include centralized patch management, which is essential for deploying patches quickly in enterprise environments.
