CVE-2016-4025

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-11-03 · updated 2026-06-17
Weakness: CWE-254

Description

Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email Server Security v8.x.x allow attackers to bypass the DeepScreen feature via a DeviceIoControl call.

Affected products

Avast Business Security: 11.1.2241, 11.1.2245, 11.1.2253, 11.1.2260, 11.1.2261, 11.1.2262
Avast Email Server Security: through 8.0.1609; 8.0.1606
Avast Endpoint Protection: through 8.0.1609; 8.0.1606
Avast Endpoint Protection Plus: 8.0.1606, 8.0.1609
Avast Endpoint Protection Suite: through 8.0.1609; 8.0.1606
Avast Endpoint Protection Suite Plus: through 8.0.1609; 8.0.1606
Avast File Server Security: through 8.0.1609; 8.0.1606
Avast Free Antivirus: 11.1.2241, 11.1.2245, 11.1.2253, 11.1.2260, 11.1.2261, 11.1.2262
Avast Internet Security: 11.1.2241, 11.1.2245, 11.1.2253, 11.1.2260, 11.1.2261, 11.1.2262
Avast Premier: 11.1.2241, 11.1.2245, 11.1.2253, 11.1.2260, 11.1.2261, 11.1.2262
Avast Pro Antivirus: 11.1.2241, 11.1.2245, 11.1.2253, 11.1.2260, 11.1.2261, 11.1.2262

References

Get alerted when CVE-2016-4025 or the next vulnerability affects your stack