Back to Database
Status published
High
CVE-2025-4134
Lack of file validation in Avast Business Antivirus for Linux allows writing untrusted update files
Vulnerability Description
Lack of file validation in do_update_vps in Avast Business Antivirus for Linux 4.5 on Linux allows local user to spoof or tamper with the update file via an unverified file write.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-4134
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- FIS Securtiy
- Nông Hoàng Tú
More from Avast
View All →CVE-2025-7007
Null pointer dereference in Avast Antivirus on macOS (16.0.0) or Linux (3.0.3)
High
7.5
CVE-2025-71326
AVAST Antivirus 25.11 Unquoted Service Path Privilege Escalation
High
8.5
CVE-2025-3500
Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation
Critical
9
CVE-2025-13032
Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 ...
Critical
9.9
CVE-2025-10905
Collision in minifilter driver of Avast Free Antivirus results in disabling of real-time protection
Medium
4.4
Affected Vendor
Avast
View all reports →Affected Software
Avast Business Antivirus
Vulnerable Versions:
4.5.1
Timeline
Official Publish:
May 28th, 2025
Last Modified:
May 28th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H