Avg Internet Security
Monthly
Local privilege escalation in Norton Antivirus, Avast Antivirus, and AVG Internet Security before version 26.5.10933 on Windows lets a low-privileged local user gain NT AUTHORITY\SYSTEM through the Data Shredder component. The flaw is a link-following defect (CWE-59): during a privileged shred operation, the component follows attacker-placed filesystem links, resulting in deletion of arbitrary files or folders that the attacker then leverages to elevate to SYSTEM. Exploitation requires authenticated local access with low privileges and depends on the privileged shred operation being performed (UI:R); a vendor patch is available, so this rates as a this-week priority rather than an emergency, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Norton Antivirus, Avast Antivirus, and AVG Internet Security before version 26.5.10933 on Windows lets a low-privileged local user gain NT AUTHORITY\SYSTEM through the Data Shredder component. The flaw is a link-following defect (CWE-59): during a privileged shred operation, the component follows attacker-placed filesystem links, resulting in deletion of arbitrary files or folders that the attacker then leverages to elevate to SYSTEM. Exploitation requires authenticated local access with low privileges and depends on the privileged shred operation being performed (UI:R); a vendor patch is available, so this rates as a this-week priority rather than an emergency, and no public exploit code has been identified at time of analysis.