Avast Antivirus CVE-2025-71326

Exploitation requires local code execution on a Windows host with Avast Antivirus 25.11 installed and the SecureLine service present and configured with an unquoted ImagePath; the attacker must be able to write an executable at one of the intermediate unquoted-path tokens (typically C:\Program.exe or similar within Program Files), which on a default Windows install means write permission to the drive root or to an intermediate Program Files subdirectory. The attacker also needs a way to cause the service to (re)start - either privileges to restart the service, a triggerable restart, or waiting for a system reboot. No user interaction is required (UI:N) and no network access is needed (AV:L); the limiting factors are the local-only vector and the filesystem ACLs governing the candidate drop paths.

The supplied CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N with high VC/VI/VA accurately reflects a local, low-complexity, low-privilege escalation to full system compromise, scoring 8.5. Publicly available exploit code exists on Exploit-DB, raising operational risk, but the vulnerability is not listed in CISA KEV and no EPSS score was provided in the input, so this is best treated as a high-impact post-compromise escalation primitive rather than an internet-exposed mass-exploitation target. A non-trivial caveat is that exploitation usually requires the attacker to drop a file at a path such as C:\Program.exe, which on default Windows installs requires Administrators write permission to the drive root - meaning successful exploitation often depends on lax ACLs on intermediate directories or on an already-permissive Program Files parent; defenders should verify drive-root and Program Files ACLs rather than assume any local user can trivially exploit it.

A standard domain user who has already obtained a low-privilege foothold on a Windows endpoint running Avast Antivirus 25.11 drops a malicious binary at an unquoted-path candidate such as C:\Program.exe (where ACLs allow) and then triggers a SecureLine service restart or waits for a reboot; the Service Control Manager launches the attacker binary as LocalSystem, yielding full SYSTEM code execution. Publicly available exploit code on Exploit-DB (52510) demonstrates the technique end-to-end and lowers the skill barrier for adversaries already operating inside the network.