Search
Find a vulnerability
Search criteria
2 vulnerabilities found for AVG Internet Security by Gen Digital
CVE-2026-6064 (GCVE-0-2026-6064)
Vulnerability from nvd – Published: 2026-10-28 10:47 – Updated: 2026-10-28 10:47
VLAI
EPSS
VEX
Title
Norton, Avast, and AVG local privilege escalation via link following in Data Shredder
Summary
Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\SYSTEM privelages.
Severity
7.3 (High)
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Norton Antivirus |
Affected:
0 , < 26.5
(custom)
|
|
| Gen Digital | Avast Antivirus |
Affected:
0 , < 26.5
(custom)
|
|
| Gen Digital | AVG Internet Security |
Affected:
0 , < 26.5
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Norton Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Avast Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "AVG Internet Security",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Anonymous working with TrendAI Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\\SYSTEM privelages."
}
],
"value": "Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\\SYSTEM privelages."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Successful exploitation allows a local, low-privileged attacker to delete arbitrary files/folders with SYSTEM integrity by substituting a reparse point (symlink/junction) for a shred target during a privileged Data Shredder operation, ultimately achieving local privilege escalation to NT AUTHORITY\\SYSTEM."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:47:51.974Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Customers are advised to upgrade to version \u0026gt;26.5 released on or after May 2026"
}
],
"value": "Customers are advised to upgrade to version \u003e26.5 released on or after May 2026"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Norton, Avast, and AVG local privilege escalation via link following in Data Shredder",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2026-6064",
"datePublished": "2026-10-28T10:47:51.974Z",
"dateReserved": "2026-04-10T12:41:15.434Z",
"dateUpdated": "2026-10-28T10:47:51.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6064 (GCVE-0-2026-6064)
Vulnerability from cvelistv5 – Published: 2026-10-28 10:47 – Updated: 2026-10-28 10:47
VLAI
EPSS
VEX
Title
Norton, Avast, and AVG local privilege escalation via link following in Data Shredder
Summary
Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\SYSTEM privelages.
Severity
7.3 (High)
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Norton Antivirus |
Affected:
0 , < 26.5
(custom)
|
|
| Gen Digital | Avast Antivirus |
Affected:
0 , < 26.5
(custom)
|
|
| Gen Digital | AVG Internet Security |
Affected:
0 , < 26.5
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Norton Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Avast Antivirus",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "AVG Internet Security",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "26.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Anonymous working with TrendAI Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\\SYSTEM privelages."
}
],
"value": "Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\\SYSTEM privelages."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Successful exploitation allows a local, low-privileged attacker to delete arbitrary files/folders with SYSTEM integrity by substituting a reparse point (symlink/junction) for a shred target during a privileged Data Shredder operation, ultimately achieving local privilege escalation to NT AUTHORITY\\SYSTEM."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:47:51.974Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Customers are advised to upgrade to version \u0026gt;26.5 released on or after May 2026"
}
],
"value": "Customers are advised to upgrade to version \u003e26.5 released on or after May 2026"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Norton, Avast, and AVG local privilege escalation via link following in Data Shredder",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2026-6064",
"datePublished": "2026-10-28T10:47:51.974Z",
"dateReserved": "2026-04-10T12:41:15.434Z",
"dateUpdated": "2026-10-28T10:47:51.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}