Read the docs
TI-2026-85983 Aliases CVE-2026-80301GHSA-8r49-5pg7-mh6x

Avast sandbox escape through COM access to Task Scheduler

Priority LOW 22CWE-280Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA.

Summary

Gen Digital's Avast, AVG and Norton antivirus products before 26.7 contain improper isolation in the Avast sandbox on Windows. A local attacker with low privileges running inside the sandbox can reach Task Scheduler COM interfaces that the sandbox policy does not block, then schedule and run code on the host with elevated privileges. The flaw is classified as CWE-653.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to access COM interfaces to the Task Scheduler service, escape containment, and execute code with elevated privileges outside the sandbox. The sandbox virtualizes file system and registry access but does not adequately restrict COM interface access to Task Scheduler. A process inside the sandbox can instantiate COM objects bound to Task Scheduler functionality and invoke methods to schedule and execute tasks on the host system. The Task Scheduler COM pathway is not blocked by the sandbox policy, allowing arbitrary code execution in the host security context. This escape vector bypasses the sandbox's intended process and file isolation boundaries and can be chained with other host-level privilege escalation techniques.

Why it matters now

EPSS 0.0016 5th percentileScored 2026-11-07
Fix Fixed Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate (Gen Digital): 26.7AVG Antivirus Free, AVG Internet Security, AVG Ultimate (Gen Digital): 26.7+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Gen DigitalAvast Antivirus, Avast One, Avast Premium Security, Avast Ultimatebefore 26.726.7Patch availableCNA
Gen DigitalAVG Antivirus Free, AVG Internet Security, AVG Ultimatebefore 26.726.7Patch availableCNA
Gen DigitalNorton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advancedbefore 26.726.7Patch availableCNA
  • Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate VendorGen Digital Affected before 26.7 Fixed in 26.7 Patch available CNA
  • AVG Antivirus Free, AVG Internet Security, AVG Ultimate VendorGen Digital Affected before 26.7 Fixed in 26.7 Patch available CNA
  • Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced VendorGen Digital Affected before 26.7 Fixed in 26.7 Patch available CNA

Remediation

Update Avast Antivirus, Avast One, Avast Premium Security and Avast Ultimate to 26.7, AVG Antivirus Free, AVG Internet Security and AVG Ultimate to 26.7, and Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe and Norton 360 Advanced to 26.7.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate (Gen Digital) Fixed in 26.7
  • Fix · CNA AVG Antivirus Free, AVG Internet Security, AVG Ultimate (Gen Digital) Fixed in 26.7
  • Fix · CNA Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced (Gen Digital) Fixed in 26.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Gen Digital AVG Antivirus Free, AVG Internet Security, AVG Ultimate, Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced 26.7

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-85985 Integer underflow in Avast WFP stream parser causes system crashPriority LOW 22
    • TI-2026-85984 Avast sandbox escape allows arbitrary host file writesPriority LOW 22
    • TI-2026-85981 Unhandled JSON exceptions let local users crash AvastSvc servicePriority LOW 22
    Show all 4 records →
  • Release ·

    Gen Digital Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate 26.7

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-85985 Integer underflow in Avast WFP stream parser causes system crashPriority LOW 22
    • TI-2026-85984 Avast sandbox escape allows arbitrary host file writesPriority LOW 22
    Show all 3 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-80301
  2. 2026-11-06 Alias added: GHSA-8r49-5pg7-mh6x

References

Patch 3

Advisory 1

  • TI-2026-57223 Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys CVSS 3.1HIGH 8.8
  • TI-2026-22110 Avira Internet Security Optimizer TOCTOU CVSS 3.1HIGH 7.8
  • TI-2026-22109 Avira Internet Security System Speedup Insecure Deserialization CVSS 3.1HIGH 7.8
  • TI-2026-22108 Avira Internet Security Arbitrary File Deletion via Improper Link Resolution CVSS 3.1HIGH 7.8
  • TI-2015-06072 Use-after-free vulnerability in the Update Manager service in Avira Management Console… CVSS 2.0HIGH 10.0
  • TI-2023-18488 An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. CVSS 3.1HIGH 7.3
See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences