Read the docs
TI-2021-08781 Aliases CVE-2021-27241GHSA-76qj-3c6g-8v48

Link following in Avast Premium Security

Priority LOW 27CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (Build 20.8.5653.561). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the AvastSvc.exe module. By creating a directory junction, an attacker can abuse the service to delete a directory. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12082.

Why it matters now

EPSS 0.0027 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AvastPremium Security20.8.2429 (Build 20.8.5653.561)—No fix listedCNA
  • Premium Security VendorAvast Affected 20.8.2429 (Build 20.8.5653.561) Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:avast:premium_security:20.8.2429:*:*:*:*:*:*:*20.8.2429VulnerableAvast
  • cpe:2.3:a:avast:premium_security:20.8.2429:*:*:*:*:*:*:* Versions 20.8.2429 Vulnerable ·Avast

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-27241
  2. 2026-10-03 Alias added: GHSA-76qj-3c6g-8v48

References

Advisory 1

  • TI-2019-13619 In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to… CVSS 3.1HIGH 7.8
  • TI-2023-22493 Link following in Avast Premium Security CVSS 3.0HIGH 7.8
  • TI-2023-22492 Incorrect authorization in Avast Premium Security CVSS 3.1HIGH 7.8
  • TI-2022-11552 An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 (build… CVSS 3.1HIGH 7.1
  • TI-2022-11553 Multiple DLL hijacking vulnerabilities via the components instup.exe and wsc_proxy.exe in… CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences