Avira vulnerabilities
We track 7 vulnerabilities in Avira products across 5 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on March 5, 2026.
Latest Avira vulnerabilities
- 7.0 High severity
Avira Internet Security: Time-of-check Time-of-use (TOCTOU) Race Condition
Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifies directories for cleanup during a scan phase and subsequently deletes them during a separate cleanu
- 7.8 High severity
Avira Internet Security: Deserialization of Untrusted Data
Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.exe process, which runs with SYSTEM privileges, deserializes data from a file located in C:\\ProgramDa
- 7.1 High severity
Avira Internet Security: Improper Link Resolution Before File Access
Avira Internet Security contains an improper link resolution vulnerability in the Software Updater component. During the update process, a privileged service running as SYSTEM deletes a file under C:\\ProgramData without validating whether the path resolves th
- 7.8 High severity
Prime: Improper Link Resolution Before File Access
Local Privilege Escalation in Avira.Spotlight.Service.exe in Avira Prime 1.1.96.2 on Windows 10 x64 allows local attackers to gain system-level privileges via arbitrary file deletion
- 7.8 High severity
Prime: Improper Link Resolution Before File Access
Avira Prime Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avira Prime. An attacker must first obtain the ability to execute low-privileged code on the targ
- 7.3 High severity
Phantom VPN: Cleartext Transmission of Sensitive Information
An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to the VPN server's IP address is sent in plaintext outside the VPN tunnel, even if this traffic is not ge
- 8.8 High severity
"Avira Security" – for Windows: Incorrect Default Permissions
A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avira Security version 1.1.72.30556.