Read the docs
TI-2026-85981 Aliases CVE-2026-12067GHSA-fpp4-5g35-6qq3

Unhandled JSON exceptions let local users crash AvastSvc service

Priority LOW 22CWE-248Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Denial of service
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA. Impact type from CWE-248.

Summary

Gen Digital Avast, AVG and Norton antivirus products before 26.7 are affected by an uncaught exception flaw (CWE-248) in the AvastSvc native message dispatcher (ashServ.dll) on Windows. JSON fields are converted to strings or integers without type validation and without exception handling, so malformed messages propagate up the dispatcher and crash the service. A local, unprivileged attacker can crash the service by sending specially crafted JSON messages.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages. The vulnerability spans multiple handler pathways in the RPC-based native message protocol: * Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries.  * OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception. * OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation. In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.

Why it matters now

EPSS 0.00157 4th percentileScored 2026-11-07
Fix Fixed Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security (Gen Digital): 26.7AVG Antivirus Free, AVG Internet Security, AVG Ultimate (Gen Digital): 26.7+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Gen DigitalAvast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Securitybefore 26.726.7Patch availableCNA
Gen DigitalAVG Antivirus Free, AVG Internet Security, AVG Ultimatebefore 26.726.7Patch availableCNA
Gen DigitalNorton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advancedbefore 26.726.7Patch availableCNA
  • Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security VendorGen Digital Affected before 26.7 Fixed in 26.7 Patch available CNA
  • AVG Antivirus Free, AVG Internet Security, AVG Ultimate VendorGen Digital Affected before 26.7 Fixed in 26.7 Patch available CNA
  • Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced VendorGen Digital Affected before 26.7 Fixed in 26.7 Patch available CNA

Remediation

Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate and Avast Business Security are fixed in 26.7. AVG Antivirus Free, AVG Internet Security and AVG Ultimate are fixed in 26.7. Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe and Norton 360 Advanced are fixed in 26.7.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security (Gen Digital) Fixed in 26.7
  • Fix · CNA AVG Antivirus Free, AVG Internet Security, AVG Ultimate (Gen Digital) Fixed in 26.7
  • Fix · CNA Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced (Gen Digital) Fixed in 26.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Gen Digital AVG Antivirus Free, AVG Internet Security, AVG Ultimate, Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced 26.7

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-85985 Integer underflow in Avast WFP stream parser causes system crashPriority LOW 22
    • TI-2026-85984 Avast sandbox escape allows arbitrary host file writesPriority LOW 22
    • TI-2026-85983 Avast sandbox escape through COM access to Task SchedulerPriority LOW 22
    Show all 4 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-12067
  2. 2026-11-06 Alias added: GHSA-fpp4-5g35-6qq3

References

Patch 3

Advisory 1

  • TI-2026-57223 Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys CVSS 3.1HIGH 8.8
  • TI-2026-22110 Avira Internet Security Optimizer TOCTOU CVSS 3.1HIGH 7.8
  • TI-2026-22109 Avira Internet Security System Speedup Insecure Deserialization CVSS 3.1HIGH 7.8
  • TI-2026-22108 Avira Internet Security Arbitrary File Deletion via Improper Link Resolution CVSS 3.1HIGH 7.8
  • TI-2015-06072 Use-after-free vulnerability in the Update Manager service in Avira Management Console… CVSS 2.0HIGH 10.0
  • TI-2023-18488 An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. CVSS 3.1HIGH 7.3
See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences