PT-2025-17876 · Avast · Avast Free Antivirus

Baris Akkaya · Published 2025-04-24 · Updated 2026-02-06 · CVE-2025-3500

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avast Antivirus versions 25.1.981.6 through 25.2.981.6 Avast Free Antivirus versions 25.1.981.6 through 25.2.981.6

Description An integer overflow or wraparound issue exists in Avast Antivirus. Successful exploitation of this issue could allow an attacker to escalate privileges and potentially execute arbitrary code within the kernel. The vulnerability is present in versions prior to 25.3. An attacker can leverage this vulnerability to gain local-to-SYSTEM privilege escalation.

Recommendations Update Avast Antivirus to version 25.3 or later. Update Avast Free Antivirus to version 25.3 or later.

Fix

LPE

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2025-3500

ZDI-25-256

Affected Products

Avast Free Antivirus

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-3500 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3500 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-256 · Security Note
• https://twitter.com/autumn_good_35/status/1917578005637128566 · Twitter Post
• https://twitter.com/0dayPublishing/status/1995537166798066119 · Twitter Post
• https://twitter.com/CveFindCom/status/1995556054776578107 · Twitter Post
• https://t.me/CVEtracker/38541 · Telegram Post
• https://t.me/cveNotify/151145 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1995537932426330454 · Twitter Post
• https://twitter.com/TheZDIBugs/status/1916930670565224633 · Twitter Post
• https://t.me/true_secator/7687 · Telegram Post
• https://twitter.com/CVEnew/status/1995529058621268317 · Twitter Post
• https://gendigital.com/us/en/contact-us/security-advisories · Note