Since antivirus software must open and inspect data in hundreds, if not thousands, of file formats. One bug in the software that does this can lead to a serious security breach.The flaws found affect every major antivirus vendor, and many of them could allow attackers to run unauthorized code on a victim's system.

People think that putting one AV engine after another is somehow defense in depth. They think that if one engine doesn't catch the worm, the other will catch it! Actually you haven't decreased your attack surface; you've increased it because every AV engine has bugs.

Between 2002 and 2005, nearly half of the vulnerabilities that were discovered in antivirus software were remotely exploitable, meaning that attackers could launch their attacks from anywhere on the Internet. Today that percentage maybe closer to 80 percent.

Full Article