CVE-2025-3500 is a critical flaw (CVSS 9.0) in Avast Antivirus on Windows. An integer overflow or wraparound allows privilege escalation. The record lists versions from 25.1.981.6 up to but not including 25.3 as affected. Update Avast Antivirus to 25.3 or later and confirm the details in the vendor advisory.
What's affected
The record says the issue affects Avast Antivirus from 25.1.981.6 before 25.3, running on Microsoft Windows. The fixed version is therefore 25.3 or newer.
The record gives few technical details. It lists the weakness as an integer overflow and the impact as privilege escalation. The reference is the Gen Digital security advisories page. Check that page for any later notes, since the record does not describe affected components, preconditions or workarounds.
How to check if you're exposed
Open Avast Antivirus on the Windows machine, then go to the menu and the About or Update section to read the installed version. Compare it with 25.3.
For many machines, use your endpoint management tool or software inventory to list the installed Avast version across the fleet. Anything between 25.1.981.6 and 25.3 should be treated as exposed. If your inventory is scattered, build one first. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related advisories.
What to do now
- List every Windows machine with Avast Antivirus installed, including personal devices that touch company data.
- Run the built in update so each machine reaches 25.3 or later.
- Confirm the version afterward through the application or your inventory tool.
- Limit local admin rights and restrict who can sign in to shared machines, since privilege escalation flaws need a local foothold first.
- Check the Gen Digital advisories page for any follow up notes.
Why it matters
The weakness is CWE-190, integer overflow or wraparound. This happens when a calculation produces a number too large for its storage type and the value wraps around. Code that then trusts that value can read or write memory it should not, which can be turned into higher privileges.
Security software runs with high privileges, so a bug in it has a bigger payoff for an attacker than a bug in a typical app. The record describes privilege escalation, not remote code execution. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not report exploitation in the wild.
Endpoint tools are part of your software inventory like anything else. Track their versions with the same care as servers and libraries.
Quick check
Is a remote attacker able to use this flaw?
The record describes privilege escalation on Windows and does not describe a remote attack path. Read the Gen Digital advisory for conditions.
What is the fixed version?
The record says the affected range ends before 25.3, so update to 25.3 or later.
Sources
Last reviewed: 18 October 2026.
