CVE-2007-2846: Heap-based buffer overflow in the SIS unpacker in avast!

Security readout for executives and security teams

This flaw is in the SIS archive unpacker used by avast! Anti-Virus Managed Client before 4.7.700. A malicious SIS archive could trigger memory corruption and potentially run attacker-controlled code. The available record describes user-assisted remote exploitation, not confirmed active exploitation. Exposure is most plausible on legacy endpoints still running avast! Anti-Virus Managed Client before 4.7.700, especially where users may receive or handle SIS archives. The source bundle does not identify other affected Avast products. Prioritize remediation if legacy avast! Managed Client exists in the environment. The business risk is code execution through security software parsing untrusted content, but urgency is reduced if the product is absent and no active exploitation evidence exists. Mitigation focus: Identify and remove avast! Managed Client versions older than 4.7.700.; Upgrade to 4.7.700 or later where this legacy product remains present.; Follow Avast vendor revision history and advisory guidance..

Prepared

Jun 29, 2026, 05:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.