Read the docs
TI-2026-85984 Aliases CVE-2026-80302GHSA-xpw6-9p2c-cjrx

Avast sandbox escape allows arbitrary host file writes

Priority LOW 22CWE-434Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Code execution
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA. Impact type from CWE-434.

Summary

Gen Digital's Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, AVG Antivirus Free, AVG Internet Security, AVG Ultimate, Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe and Norton 360 Advanced are affected before 26.7. The Windows sandbox file virtualization does not isolate some write requests correctly (CWE-653), so writes reach protected host locations. A local attacker with low privilege inside the sandbox can write arbitrary files outside containment, overwrite executables, system libraries or startup configuration, and run code with host privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker executing inside the sandbox to write arbitrary files outside sandbox containment and execute code on the host. The sandbox virtualizes file system operations by intercepting write requests to protected system directories. However, the virtualization implementation fails to properly validate write targets in certain edge cases, allowing writes to bypass the virtualization redirection and reach the actual host file system in protected locations. An attacker can exploit this to overwrite executable files, system libraries, or startup configurations with arbitrary content, leading to code execution with host privileges on subsequent system operations or reboot.

Why it matters now

EPSS 0.00169 6th percentileScored 2026-11-07
Fix Fixed Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate (Gen Digital): 26.7AVG Antivirus Free, AVG Internet Security, AVG Ultimate (Gen Digital): 26.7+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Gen DigitalAvast Antivirus, Avast One, Avast Premium Security, Avast Ultimatebefore 26.726.7Patch availableCNA
Gen DigitalAVG Antivirus Free, AVG Internet Security, AVG Ultimatebefore 26.726.7Patch availableCNA
Gen DigitalNorton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advancedbefore 26.726.7Patch availableCNA
  • Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate VendorGen Digital Affected before 26.7 Fixed in 26.7 Patch available CNA
  • AVG Antivirus Free, AVG Internet Security, AVG Ultimate VendorGen Digital Affected before 26.7 Fixed in 26.7 Patch available CNA
  • Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced VendorGen Digital Affected before 26.7 Fixed in 26.7 Patch available CNA

Remediation

Update Avast Antivirus, Avast One, Avast Premium Security and Avast Ultimate to 26.7, AVG Antivirus Free, AVG Internet Security and AVG Ultimate to 26.7, and Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe and Norton 360 Advanced to 26.7.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate (Gen Digital) Fixed in 26.7
  • Fix · CNA AVG Antivirus Free, AVG Internet Security, AVG Ultimate (Gen Digital) Fixed in 26.7
  • Fix · CNA Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced (Gen Digital) Fixed in 26.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Gen Digital AVG Antivirus Free, AVG Internet Security, AVG Ultimate, Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced 26.7

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-85985 Integer underflow in Avast WFP stream parser causes system crashPriority LOW 22
    • TI-2026-85983 Avast sandbox escape through COM access to Task SchedulerPriority LOW 22
    • TI-2026-85981 Unhandled JSON exceptions let local users crash AvastSvc servicePriority LOW 22
    Show all 4 records →
  • Release ·

    Gen Digital Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate 26.7

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-85985 Integer underflow in Avast WFP stream parser causes system crashPriority LOW 22
    • TI-2026-85983 Avast sandbox escape through COM access to Task SchedulerPriority LOW 22
    Show all 3 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-80302
  2. 2026-11-06 Alias added: GHSA-xpw6-9p2c-cjrx

References

Patch 3

Advisory 1

  • TI-2026-57223 Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys CVSS 3.1HIGH 8.8
  • TI-2026-22110 Avira Internet Security Optimizer TOCTOU CVSS 3.1HIGH 7.8
  • TI-2026-22109 Avira Internet Security System Speedup Insecure Deserialization CVSS 3.1HIGH 7.8
  • TI-2026-22108 Avira Internet Security Arbitrary File Deletion via Improper Link Resolution CVSS 3.1HIGH 7.8
  • TI-2015-06072 Use-after-free vulnerability in the Update Manager service in Avira Management Console… CVSS 2.0HIGH 10.0
  • TI-2023-18488 An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. CVSS 3.1HIGH 7.3
See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences