TI-2024-06693 Aliases CVE-2024-7228 GHSA-3hqr-6848-jx5j

Link following in Avast Free Antivirus

LOW 25CWE-59Published 2024-11-22 · Updated 2024-11-23

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-59 and the CVSS impact.

Summary

Avast Free Antivirus Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Avast Free Antivirus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Avast Service. By creating a symbolic link, an attacker can abuse the service to create a folder. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-22806.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00306 23rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Avast	Free Antivirus	23.11.6090 Build 23.11.8365.809	—	No fix listed	CNA

Free Antivirus VendorAvast Affected 23.11.6090 Build 23.11.8365.809 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:avast:free_antivirus:23.11.6090:build_23.11.8365.809::::::	23.11.6090 build_23.11.8365.809	Vulnerable	Avast

cpe:2.3:a:avast:free_antivirus:23.11.6090:build_23.11.8365.809:*:*:*:*:*:* Versions 23.11.6090 build_23.11.8365.809 Vulnerable ·Avast

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-7228
2026-10-03 Alias added: GHSA-3hqr-6848-jx5j

References

Advisory 1

ZDI-24-999

TI-2024-06698 Link following in Avast Free Antivirus CVSS 3.1HIGH 7.8
TI-2024-06697 Link following in Avast Free Antivirus CVSS 3.1HIGH 7.8
TI-2024-06692 Link following in Avast Free Antivirus CVSS 3.1HIGH 7.8
TI-2018-09022 Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login… CVSS 3.0HIGH 7.8
TI-2017-03573 Code injection vulnerability in Avast Premier 12.3 (and earlier), Internet Security 12.3… CVSS 3.0MEDIUM 6.7
TI-2020-10717 An elevation of privilege vulnerability exists in Avast Free Antivirus and AVG AntiVirus… CVSS 3.1MEDIUM 5.5

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences