AVG Internet Security link-following bug enables local privilege escalation
ZDI-26-832, tracked as CVE-2026-6064 and scored 7.3, needs existing low-privileged code execution.
44
CVE-2026-6064
Link-following privilege escalation in Norton, Avast, and AVG shredder
- CVSS 3.1
- 7.3 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A link-following flaw in the Data Shredder of Norton Antivirus, Avast Antivirus, and AVG Internet Security on Windows lets a local, low-privileged user escalate to NT AUTHORITY\SYSTEM. During a privileged shred, the attacker can cause arbitrary file or folder deletion and use that to gain SYSTEM. User interaction is required. Builds before 26.5.10933 are affected.
What to do: Update Norton Antivirus, Avast Antivirus, and AVG Internet Security to 26.5.10933 or later.
| Product | Affected | Fixed in |
|---|---|---|
| NortonLifeLock Norton Antivirus | prior to 26.5.10933 | 26.5.10933 |
| NortonLifeLock Avast Antivirus | prior to 26.5.10933 | 26.5.10933 |
| NortonLifeLock AVG Internet Security | prior to 26.5.10933 | 26.5.10933 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\SYSTEM privelages.
- Weakness
- CWE-59
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H