TI-2024-05380 Aliases CVE-2024-5803 GHSA-ccfh-v7cp-3943

Local privelage escalation via COM hijacking

LOW 34CWE-367Published 2024-10-03 · Updated 2024-10-03

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The AVGUI.exe of AVG/Avast Antivirus before versions before 24.1 can allow a local attacker to escalate privileges via an COM hijack in a time-of-check to time-of-use (TOCTOU) when self protection is disabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0011 1st percentileScored 2026-11-07

Fix Fixed Antivirus (AVG/Avast): 24.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Avast	Antivirus	before 24.1	24.1	Patch available	CNA

Antivirus VendorAvast Affected before 24.1 Fixed in 24.1 Patch available CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:avg:avg_anti-virus::::::::	—	—	AVG

cpe:2.3:a:avg:avg_anti-virus:*:*:*:*:*:*:*:* Versions — — ·AVG

Remediation

Fix · CNA Antivirus (AVG/Avast) Fixed in 24.1

Timeline

2026-10-02 Threatist record created from CVE-2024-5803
2026-10-03 Alias added: GHSA-ccfh-v7cp-3943

References

Other 1

https://support.norton.com/sp/static/external/tools/security-advisories.html

TI-2025-43447 AVAST Antivirus 25.11 Unquoted Service Path Privilege Escalation CVSS 4.0HIGH 8.5
TI-2020-19172 AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path CVSS 4.0HIGH 8.5
TI-2010-02987 Untrusted search path vulnerability in avast! Free Antivirus version 5.0.594 and earlier… CVSS 2.0HIGH 9.3
TI-2007-02752 Heap-based buffer overflow in the CAB unpacker in avast! Anti-Virus Managed Client before… CVSS 2.0HIGH 9.3
TI-2020-14724 An issue was discovered in retdec v3.3. CVSS 3.1CRITICAL 9.8
TI-2020-08753 An issue was discovered in Avast Antivirus before 20. CVSS 3.1CRITICAL 9.8

See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences