Read the docs
TI-2023-01495 Aliases CVE-2023-1585GHSA-rh45-x729-x2qp

Time-of-check time-of-use race condition in Avast Antivirus

Priority LOW 28CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quarantine process, leading to arbitrary file/directory deletion. The issue was fixed with Avast and AVG Antivirus version 22.11 and virus definitions from 14 February 2023 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00167 5th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AvastAvast Antivirus22.5 – 22.10—No fix listedCNA
AVGAVG Antivirus22.5 – 22.10—No fix listedCNA
  • Avast Antivirus VendorAvast Affected 22.5 – 22.10 Fixed in — No fix listed CNA
  • AVG Antivirus VendorAVG Affected 22.5 – 22.10 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:avast:antivirus:*:*:*:*:*:*:*:*22.5 to before 22.11VulnerableAvast
cpe:2.3:a:avg:anti-virus:*:*:*:*:*:*:*:*22.5 to before 22.11VulnerableAVG
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:avast:antivirus:*:*:*:*:*:*:*:* Versions 22.5 to before 22.11 Vulnerable ·Avast
  • cpe:2.3:a:avg:anti-virus:*:*:*:*:*:*:*:* Versions 22.5 to before 22.11 Vulnerable ·AVG
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1585
  2. 2026-10-03 Alias added: GHSA-rh45-x729-x2qp

References

Advisory 1

  • TI-2020-08753 An issue was discovered in Avast Antivirus before 20. CVSS 3.1CRITICAL 9.8
  • TI-2017-05872 In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe… CVSS 3.0CRITICAL 9.8
  • TI-2025-03074 Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation CVSS 3.1CRITICAL 9.8
  • TI-2025-11929 Time-of-check time-of-use race condition in Avast Antivirus CVSS 3.1CRITICAL 9.9
  • TI-2021-20488 Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to… CVSS 3.1HIGH 8.8
  • TI-2021-20487 Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to… CVSS 3.1HIGH 8.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences