Read the docs
TI-2026-57223 Aliases CVE-2026-82964GHSA-r5c7-vpw8-xf4v

Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys

Priority HIGH 73CWE-281Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM. When the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES only, omitting WRITE_DAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRP_MJ_CREATE callback additionally did not strip WRITE_DAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM. The absence of an IRP_MJ_SET_SECURITY callback in the driver's operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00157 4th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security (Gen Digital): 26.8AVG Antivirus Free, AVG Internet Security, AVG Ultimate (Gen Digital): 26.8+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Gen DigitalAvast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Securitybefore 26.826.8Patch availableCNA
Gen DigitalAVG Antivirus Free, AVG Internet Security, AVG Ultimatebefore 26.826.8Patch availableCNA
Gen DigitalNorton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advancedbefore 26.826.8Patch availableCNA
  • Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security VendorGen Digital Affected before 26.8 Fixed in 26.8 Patch available CNA
  • AVG Antivirus Free, AVG Internet Security, AVG Ultimate VendorGen Digital Affected before 26.8 Fixed in 26.8 Patch available CNA
  • Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced VendorGen Digital Affected before 26.8 Fixed in 26.8 Patch available CNA

Remediation

  • Fix · CNA Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security (Gen Digital) Fixed in 26.8
  • Fix · CNA AVG Antivirus Free, AVG Internet Security, AVG Ultimate (Gen Digital) Fixed in 26.8
  • Fix · CNA Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced (Gen Digital) Fixed in 26.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82964
  2. 2026-10-03 Alias added: GHSA-r5c7-vpw8-xf4v

References

Exploit 1

Patch 3

Advisory 1

Other 1

  • TI-2026-22110 Avira Internet Security Optimizer TOCTOU CVSS 3.1HIGH 7.8
  • TI-2026-22109 Avira Internet Security System Speedup Insecure Deserialization CVSS 3.1HIGH 7.8
  • TI-2026-22108 Avira Internet Security Arbitrary File Deletion via Improper Link Resolution CVSS 3.1HIGH 7.8
  • TI-2015-06072 Use-after-free vulnerability in the Update Manager service in Avira Management Console… CVSS 2.0HIGH 10.0
  • TI-2023-18488 An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. CVSS 3.1HIGH 7.3
  • TI-2012-01281 The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir… CVSS 2.0MEDIUM 4.3
See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences