Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\\SYSTEM via a section header with a very large relative virtual address in a PE file causing an integer overflow and heap-based buffer underflow.