Vulnerability record · CVE-2016-4025 · published 3 November 2016

CVE-2016-4025: Avast business security vulnerability

Avast · Business Security

Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email Server Security v8.x.x allow attackers to bypass the DeepScreen feature via a DeviceIoControl call.

5.5 CVSS 3.0 Medium EPSS 0.40% · top 68.3% CWE-254 · CWE-254

5.5CVSS 3.0 base score, v2 2.1

0.40%EPSS exploitation probability, 30 days

NoNot in CISA KEV

11Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

11 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Business Security Avast

Email Server Security Avast

Endpoint Protection Avast

Endpoint Protection Plus Avast

Endpoint Protection Suite Avast

Endpoint Protection Suite Plus Avast

File Server Security Avast

Free Antivirus Avast

Internet Security Avast

Premier Avast

Pro Antivirus Avast

References

Link	Tags
https://labs.nettitude.com/blog/escaping-avast-sandbox-using-single-ioctl-cve-2016-4025/	Technical DescriptionThird Party Advisory
https://labs.nettitude.com/blog/escaping-avast-sandbox-using-single-ioctl-cve-2016-4025/	Technical DescriptionThird Party Advisory

Track CVE-2016-4025 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Source: NIST National Vulnerability Database (record CVE-2016-4025), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.