TI-2016-08452 Aliases CVE-2016-10402 GHSA-xgv2-68c7-qh64

Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT…

MEDIUM 47CWE-119Published 2017-07-27 · Updated 2024-08-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large relative virtual address in a PE file, causing an integer overflow and heap-based buffer underflow.

Why it matters now

EPSS 0.10215 95th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:avira:antivirus::::::windows::*	up to 8.3.36.59	Vulnerable	Gen Digital

cpe:2.3:a:avira:antivirus:*:*:*:*:*:windows:*:* Versions up to 8.3.36.59 Vulnerable ·Gen Digital

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2016-10402
2026-10-03 Alias added: GHSA-xgv2-68c7-qh64

References

Advisory 1

https://bugs.chromium.org/p/project-zero/issues/detail?id=765

TI-2023-01785 Integer overflow in Gen Digital Avira Antivirus CVSS 3.1HIGH 7.8
TI-2020-09790 Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences