Read the docs
TI-2026-85985 Aliases CVE-2026-80303GHSA-2q9r-4cp6-374g

Integer underflow in Avast WFP stream parser causes system crash

Priority LOW 22CWE-191Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Denial of service
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA. Impact type from CWE-248.

Summary

Gen Digital's Avast, AVG and Norton antivirus products before 26.7 are affected. An integer underflow (CWE-191) in the WFP stream parser's length calculation occurs because input stream sizes are not validated. A remote attacker can trigger it with crafted network traffic to a filtered port, or a local user with crafted data sent to the filtering interface, causing a kernel panic and system crash.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causing a system crash. The WFP callout driver processes network stream data and computes length values for packet fragment reassembly. The length calculation does not properly validate input stream sizes against expected boundaries. When processing specially crafted input, the length computation underflows, resulting in allocation or buffer access with an extremely large wrapped-around size value. The underflow can be triggered remotely via network traffic destined for the filtered port, or locally via crafted data provided to the filtering interface. The resulting memory allocation failure or out-of-bounds access causes a kernel panic and system crash.

Why it matters now

EPSS 0.00157 4th percentileScored 2026-11-07
Fix Fixed Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate (Gen Digital): 26.7AVG Antivirus Free, AVG Internet Security, AVG Ultimate (Gen Digital): 26.7+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Gen DigitalAvast Antivirus, Avast One, Avast Premium Security, Avast Ultimatebefore 26.726.7Patch availableCNA
Gen DigitalAVG Antivirus Free, AVG Internet Security, AVG Ultimatebefore 26.726.7Patch availableCNA
Gen DigitalNorton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advancedbefore 26.726.7Patch availableCNA
  • Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate VendorGen Digital Affected before 26.7 Fixed in 26.7 Patch available CNA
  • AVG Antivirus Free, AVG Internet Security, AVG Ultimate VendorGen Digital Affected before 26.7 Fixed in 26.7 Patch available CNA
  • Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced VendorGen Digital Affected before 26.7 Fixed in 26.7 Patch available CNA

Remediation

Version 26.7 fixes Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, AVG Antivirus Free, AVG Internet Security, AVG Ultimate, Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe and Norton 360 Advanced.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate (Gen Digital) Fixed in 26.7
  • Fix · CNA AVG Antivirus Free, AVG Internet Security, AVG Ultimate (Gen Digital) Fixed in 26.7
  • Fix · CNA Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced (Gen Digital) Fixed in 26.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Gen Digital AVG Antivirus Free, AVG Internet Security, AVG Ultimate, Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced 26.7

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-85984 Avast sandbox escape allows arbitrary host file writesPriority LOW 22
    • TI-2026-85983 Avast sandbox escape through COM access to Task SchedulerPriority LOW 22
    • TI-2026-85981 Unhandled JSON exceptions let local users crash AvastSvc servicePriority LOW 22
    Show all 4 records →
  • Release ·

    Gen Digital Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate 26.7

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-85984 Avast sandbox escape allows arbitrary host file writesPriority LOW 22
    • TI-2026-85983 Avast sandbox escape through COM access to Task SchedulerPriority LOW 22
    Show all 3 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-80303
  2. 2026-11-06 Alias added: GHSA-2q9r-4cp6-374g

References

Patch 3

Advisory 1

  • TI-2026-57223 Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys CVSS 3.1HIGH 8.8
  • TI-2026-22110 Avira Internet Security Optimizer TOCTOU CVSS 3.1HIGH 7.8
  • TI-2026-22109 Avira Internet Security System Speedup Insecure Deserialization CVSS 3.1HIGH 7.8
  • TI-2026-22108 Avira Internet Security Arbitrary File Deletion via Improper Link Resolution CVSS 3.1HIGH 7.8
  • TI-2015-06072 Use-after-free vulnerability in the Update Manager service in Avira Management Console… CVSS 2.0HIGH 10.0
  • TI-2023-18488 An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. CVSS 3.1HIGH 7.3
See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences