Norton Antivirus EUVD-2026-111873

Requires an already-authenticated, low-privileged local user on a Windows system running Norton Antivirus, Avast Antivirus, or AVG Internet Security prior to 26.5.10933, with the Data Shredder component present. The attacker must be able to create filesystem links (symbolic links/junctions) that the Data Shredder's privileged shred operation then follows, and exploitation depends on that privileged shred (delete) operation being performed (CVSS UI:R). Limiting factors: no remote vector (AV:L), prior local access and low privileges are prerequisites, the specific shred operation must occur, and exploitation is confined to the Windows builds below the fixed version - a fixed release (26.5.10933) is available from the vendor as the remediation.

This is a credible but second-tier priority: a local privilege-escalation flaw (CWE-59 link following) rather than a remotely reachable one. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U) confirms the attacker must already have local, low-privileged code execution and relies on user interaction - a privileged Data Shredder shred operation being performed - so this is not a wormable or mass-exploitable issue. The 7.3 (High) base score is driven by the full C:H/I:H/A:H impact that results from escalating to NT AUTHORITY\SYSTEM, which is the realistic worst case for a local EoP. No EPSS score, SSVC exploitation-status data, or KEV entry was provided in the input; the vuln.today Decision label is 'this_week' (not act_now/emergency), consistent with a patch-available local EoP that warrants prompt but not emergency action. There is no exploitation signal in the input: no KEV listing and no PoC/exploit reference, so this should be treated as a patch-this-cycle defect, not an active-exploitation fire drill. The CVSS vector and the description are internally consistent (both indicate local access and a user-triggered privileged operation), so no vector/description conflict needs flagging.

A low-privileged user on a Windows host logged into Norton, Avast, or AVG plants a crafted symbolic link or junction so that when the product's Data Shredder performs a privileged shred (delete) operation, the SYSTEM-level service follows the attacker-controlled link and deletes or manipulates an arbitrary file/folder outside the intended target. The attacker leverages this arbitrary deletion primitive to escalate to NT AUTHORITY\SYSTEM. No public exploit identified at time of analysis, so this scenario is inferred from the link-following mechanism described by the vendor rather than from released exploit code.