CVE-2026-6676: Avira antivirus engine heap buffer OOB write when scanning a malformed POSIX tar archive

Synopsis

A heap buffer out-of-bounds write vulnerability exists in the Avira Antivirus engine when it processes a malformed POSIX tar archive. The flaw is triggered locally and requires no authentication, but does require a user to open or scan a crafted archive file. Successful exploitation enables an attacker to execute arbitrary code in the context of the antivirus engine process or crash it entirely. A patched-image rebuild at engine version 8.3.27.12 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required to trigger the vulnerability.

• AuthenticationNot required

  No account credentials or prior authentication are needed; any unprivileged local presence is sufficient to deliver a malformed archive.

• Victim interactionRequired

  A user or automated process must open or initiate a scan of a crafted POSIX tar archive for the vulnerable code path to be reached.

• Attack complexityDetail

  The exploit is reliable and condition-free once the malformed archive is scanned, with no race conditions or memory-layout dependencies required.

Blast Radius

• An attacker achieves arbitrary code execution in the context of the Avira Antivirus engine process, which commonly runs with elevated privileges.
• Confidential data accessible to the engine process, including file contents under scan and cached scan results, becomes readable to the attacker.
• The attacker can modify files or state accessible to the engine process, potentially corrupting scan databases or quarantine records.
• A crafted archive can crash the antivirus engine process entirely, disabling real-time protection and leaving the host unscanned.