Avast Free Antivirus, Avast One, Avast Premium…: Improper Preservation of Permissions
CVE-2026-82964 is a high-severity improper preservation of permissions vulnerability in Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security from Gen Digital, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists version 26.8 as the first without the flaw, so updating Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.16% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security to 26.8 or a later version.
- Update AVG Antivirus Free, AVG Internet Security, AVG Ultimate to 26.8 or a later version.
- Update Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced to 26.8 or a later version.
- Read the advisory on gendigital.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Gen Digital | Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security | before 26.8 | 26.8 |
| Gen Digital | AVG Antivirus Free, AVG Internet Security, AVG Ultimate | before 26.8 | 26.8 |
| Gen Digital | Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced | before 26.8 | 26.8 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scored by CNA (nortonlifelock.com).
Official description
Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM. When the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES only, omitting WRITE_DAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRP_MJ_CREATE callback additionally did not strip WRITE_DAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM. The absence of an IRP_MJ_SET_SECURITY callback in the driver's operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
More Improper Preservation of Permissions vulnerabilities (CWE-281)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: poc, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
Recent Improper Preservation of Permissions vulnerabilities
- 9.4 Critical severity
- 8.8 High severity
- 7.8 High severity
- 8.8 High severity
- 8.1 High severity
- 7.5 High severity
Spotted an error? Tell us.