Read the docs
TI-2026-22108 Aliases CVE-2026-27748GHSA-w3vx-x8fj-r29m

Avira Internet Security Arbitrary File Deletion via Improper Link Resolution

Priority HIGH 69CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Avira Internet Security contains an improper link resolution vulnerability in the Software Updater component. During the update process, a privileged service running as SYSTEM deletes a file under C:\\ProgramData without validating whether the path resolves through a symbolic link or reparse point. A local attacker can create a malicious link to redirect the delete operation to an arbitrary file, resulting in deletion of attacker-chosen files with SYSTEM privileges. This may lead to local privilege escalation, denial of service, or system integrity compromise depending on the targeted file and operating system configuration.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00194 9th percentileScored 2026-11-07
Fix Fixed Avira Internet Security (Gen Digital Inc.): 1.1.114.3113

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Gen DigitalAvira Internet Securityup to 1.1.109.19901.1.114.3113Patch availableCNA
  • Avira Internet Security VendorGen Digital Affected up to 1.1.109.1990 Fixed in 1.1.114.3113 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:avira:internet_security:*:*:*:*:*:windows:*:*before 1.1.114.3113VulnerableGen Digital
  • cpe:2.3:a:avira:internet_security:*:*:*:*:*:windows:*:* Versions before 1.1.114.3113 Vulnerable ·Gen Digital

Remediation

  • Fix · CNA Avira Internet Security (Gen Digital Inc.) Fixed in 1.1.114.3113

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27748
  2. 2026-10-03 Alias added: GHSA-w3vx-x8fj-r29m

References

Advisory 1

Other 2

  • TI-2026-22110 Avira Internet Security Optimizer TOCTOU CVSS 3.1HIGH 7.8
  • TI-2026-22109 Avira Internet Security System Speedup Insecure Deserialization CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences