CVE-2026-82964

CVE-2026-82964 is an improper preservation of permissions (CWE-281/CWE-862) in the Avast sandbox minifilter driver (aswSnx.sys) on Windows: the driver opens virtualization target objects with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES but omits WRITE_DAC, so every attempt to reapply the original security descriptor fails silently, leaving virtualized copies of sensitive files with permissive permissions. The IRP_MJ_CREATE callback also fails to strip WRITE_DAC for sensitive directories, allowing a local, low-privileged process running inside the Avast sandbox to rewrite the security descriptor of a virtualized object and read its virtualized copy. By doing so against the SAM database, the attacker extracts local NTLM password hashes and can execute code as SYSTEM, fully escaping the sandbox's file isolation. Any Windows host running Avast products with the sandbox driver loaded is potentially affected, though the attack requires a low-privileged attacker already executing inside the sandbox. No public proof-of-concept is known, the flaw is not on CISA's KEV list, and no in-the-wild exploitation has been reported.

What to do: Update Avast/Gen Digital products to the latest available patched release once the vendor publishes a fixed version (no fixed version is given in the source data), and watch for Gen Digital advisories referencing CVE-2026-82964. Until patched, avoid running untrusted low-privileged code inside Avast's sandbox, and treat unexpected writes to security descriptors on sandbox-virtualized objects as suspicious. Note that the missing IRP_MJ_SET_SECURITY callback is only a defense-in-depth gap; patching must address the WRITE_DAC handling, not just add that callback.