EUVD-2026-80773
GHSA-r5c7-vpw8-xf4v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local sandboxed low-priv execution (AV:L/PR:L), reliable (AC:L), and the sandbox-escape to SYSTEM crosses a security boundary (S:C) yielding full C:H/I:H/A:H.
Primary rating from Vendor (GEN).
CVSS VectorVendor: GEN
Lifecycle Timeline
6DescriptionCVE.org
Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM.
When the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES only, omitting WRITE_DAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRP_MJ_CREATE callback additionally did not strip WRITE_DAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM.
The absence of an IRP_MJ_SET_SECURITY callback in the driver's operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack.
AnalysisAI
Sandbox escape in the Avast/AVG/Norton sandbox minifilter driver (aswSnx.sys) on Windows allows an authenticated, low-privileged process already executing inside the sandbox to break file isolation and escalate to SYSTEM (CVSS 8.8, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-281). The driver opens the virtualization target with only GENERIC_WRITE and FILE_WRITE_ATTRIBUTES, omitting WRITE_DAC, so every attempt to reapply the original DACL fails silently and virtualized copies of sensitive files are left with permissive permissions; the IRP_MJ_CREATE handler additionally fails to strip WRITE_DAC for sensitive directories, letting a sandboxed process rewrite the security descriptor of a virtualized object, read the virtualized SAM copy, extract local NTLM hashes and run code as SYSTEM. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already be executing as a low-privileged process INSIDE the Avast/AVG/Norton sandbox on a Windows host, and requires the sandbox file-virtualization feature to virtualize a sensitive object (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, high-priority local privilege escalation, not a paper high-CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary fix: install the current vendor build for the affected Gen Digital product - Avast updates are distributed via https://support.avast.com/en-us/article/Update-Antivirus, AVG via https://support.avg.com/SupportArticleView?l=en&urlname=Update-AVG-Antivirus, and Norton via https://support.norton.com/sp/en/us/home/current/solutions/v20240108175512167, with consolidated advisory information at https://www.gendigital.com/us/en/contact-us/security-advisories/ (patch status: patch available per vendor advisory; no exact fixed build number is published in the reference data, so verify the installed aswSnx.sys version against the vendor's support pages rather than assuming a specific release). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all endpoints running Avast, AVG, or Norton products and apply the vendor-released patches for the affected versions (Patch available per vendor advisory; see vendor for exact version numbers). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Same weakness CWE-281 – Improper Preservation of Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today