Avast Sandbox CVE-2026-82964

Exploitation requires the attacker to already be executing as a low-privileged process INSIDE the Avast/AVG/Norton sandbox on a Windows host, and requires the sandbox file-virtualization feature to virtualize a sensitive object (e.g. the SAM database). The concrete flaw: the driver opens the virtualization target with only GENERIC_WRITE and FILE_WRITE_ATTRIBUTES (omitting WRITE_DAC), so applying the original DACL silently fails and leaves virtualized copies with permissive permissions; additionally IRP_MJ_CREATE does not strip WRITE_DAC for sensitive directories, letting the sandboxed process rewrite the object's security descriptor. Limiting factors: local access only (no remote vector), attacker must first obtain execution within the sandbox, and the target product must be installed and using sandbox virtualization - but no user interaction or elevated privileges are needed beyond initial sandboxed code execution, and a public PoC exists.

This is a genuine, high-priority local privilege escalation, not a paper high-CVSS. The CVSS 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is well-calibrated: AV:L correctly reflects that the attacker must already be executing inside the Avast/AVG/Norton sandbox, PR:L reflects a low-privileged sandboxed process, and S:C captures the sandbox-to-host escape ending in SYSTEM code execution. Publicly available exploit code exists (GitHub MSNightmare/PrettyPrague plus an associated X/Twitter post), which materially raises real-world risk versus a theory-only bug. It is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active mass exploitation - but for a local EoP with a working PoC against consumer antivirus, EPSS/KEV are weak signals anyway (local EoP rarely drives high EPSS or KEV listing). No SSVC decision data was supplied. Signals are consistent, not conflicting: high technical impact (full SYSTEM, SAM/NTLM disclosure), local vector, public PoC, vendor patch available. The main limiter is that the attacker must first land code inside the sandbox, making this a post-compromise escalation / defense-defeating primitive rather than an initial-access vector.

A low-privileged process running inside the Avast/AVG/Norton sandbox (e.g. suspect malware detonated by the AV, or attacker code deliberately run under sandboxing) abuses the driver's failure to preserve DACLs: because virtualized copies inherit permissive permissions and WRITE_DAC is not stripped, the process rewrites the security descriptor of a virtualized object, reads the virtualized copy of the SAM database, and extracts local NTLM hashes to execute code as SYSTEM. Publicly available exploit code (GitHub MSNightmare/PrettyPrague) demonstrates the chain, lowering the skill barrier. Because AV:L/AC:L, the attack is reliable once code executes inside the sandbox.