Avast
46 CVEs across 43 Avast products. Browse Avast vulnerabilities, severities, and proof-of-concept exploits.
Avast products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-71326 | High | 7.8 | 2026-06-19 | AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with ele… |
CVE-2020-37037 | High | 7.8 | 2026-02-01 | Avast SecureLine 5.5.522.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges… |
CVE-2025-7007 | High | 7.5 | 2025-12-01 | NULL Pointer Dereference vulnerability in Avast Antivirus on MacOS, Avast Anitvirus on Linux when scanning a malformed Windows PE file causes the antivirus pro… |
CVE-2025-8351 | High | 7.8 | 2025-12-01 | Heap-based Buffer Overflow, Out-of-bounds Read vulnerability in Avira Antivirus engine when scanning a malformed file may allow Local Execution of Code or Deni… |
CVE-2025-3500 | Critical | 9.0 | 2025-12-01 | Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981… |
CVE-2025-10101 | High | 7.8 | 2025-12-01 | Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Mach-O file may allow Local Execution of Code or Denial-of-Service of… |
CVE-2025-13032 | Critical | 9.9 | 2025-11-11 | Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflow. |
CVE-2025-10905 | Medium | 4.4 | 2025-11-11 | Collision in MiniFilter driver in Avast Software Avast Free Antivirus before 25.9 on Windows allows a local attacker with administrative privileges to disabl… |
CVE-2025-4134 | High | 7.3 | 2025-05-28 | Lack of file validation in do_update_vps in Avast Business Antivirus for Linux 4.5 on Linux allows local user to spoof or tamper with the update file via an un… |
CVE-2024-13962 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Gen Digital Inc. Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 a… |
CVE-2024-13961 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attac… |
CVE-2024-13944 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows… |
CVE-2024-7233 | High | 7.8 | 2024-11-22 | Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affe… |
CVE-2024-7232 | High | 7.8 | 2024-11-22 | Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affe… |
CVE-2024-7231 | High | 7.8 | 2024-11-22 | Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected ins… |
CVE-2024-7230 | High | 7.8 | 2024-11-22 | Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected ins… |
CVE-2024-7229 | High | 7.8 | 2024-11-22 | Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected ins… |
CVE-2024-7228 | Medium | 5.5 | 2024-11-22 | Avast Free Antivirus Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affec… |
CVE-2024-7227 | High | 7.8 | 2024-11-22 | Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affe… |
CVE-2024-9484 | Medium | 5.1 | 2024-10-04 | An null-pointer-derefrence in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed xar file to cras… |
CVE-2024-9483 | Medium | 5.1 | 2024-10-04 | A null-pointer-dereference in the signature verification module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS may allow a malform… |
CVE-2024-9482 | Medium | 5.1 | 2024-10-04 | An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed Mach-O file to crash… |
CVE-2024-9481 | Medium | 5.1 | 2024-10-04 | An out-of-bounds write in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformed eml file to crash th… |
CVE-2024-5102 | High | 7.0 | 2024-06-10 | A sym-linked file accessed via the repair function in Avast Antivirus <24.2 on Windows may allow user to elevate privilege to delete arbitrary files or run pro… |
CVE-2023-42125 | High | 7.8 | 2024-05-03 | Avast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges o… |
CVE-2023-42124 | High | 7.8 | 2024-05-03 | Avast Premium Security Sandbox Protection Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate pri… |
CVE-2023-5760 | High | 8.2 | 2023-11-08 | A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability… |
CVE-2020-20118 | Medium | 5.5 | 2023-07-11 | Buffer Overflow vulnerability in Avast AntiVirus before v.19.7 allows a local attacker to cause a denial of service via a crafted request to the aswSnx.sys dri… |
CVE-2023-1587 | Medium | 5.8 | 2023-04-19 | Avast and AVG Antivirus for Windows were susceptible to a NULL pointer dereference issue via RPC-interface. The issue was fixed with Avast and AVG Antivirus ve… |
CVE-2023-1586 | Medium | 6.5 | 2023-04-19 | Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the restore process leading to arbitrary file cr… |
CVE-2023-1585 | Medium | 6.5 | 2023-04-19 | Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quarantine process, leading to arbitrary fil… |
CVE-2022-4294 | High | 7.1 | 2023-01-10 | Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may… |
CVE-2022-4291 | High | 7.7 | 2022-12-08 | The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass… |
CVE-2022-4173 | High | 7.3 | 2022-12-06 | A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write access to the filesystem, to escalate his pr… |
CVE-2022-28965 | Medium | 6.5 | 2022-05-20 | Multiple DLL hijacking vulnerabilities via the components instup.exe and wsc_proxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute… |
CVE-2022-28964 | High | 7.1 | 2022-05-20 | An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 (build 21.11.6809.528) allows attackers to cause a Denial of Service (DoS) v… |
CVE-2021-45339 | High | 7.8 | 2021-12-27 | Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted process which could… |
CVE-2021-45338 | High | 7.8 | 2021-12-27 | Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessarily powerful… |
CVE-2021-45337 | High | 8.8 | 2021-12-27 | Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain elevated priv… |
CVE-2021-45336 | High | 8.8 | 2021-12-27 | Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated privileges by using… |
CVE-2021-45335 | High | 8.8 | 2021-12-27 | Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefor… |
CVE-2020-23907 | Critical | 9.8 | 2021-04-21 | An issue was discovered in retdec v3.3. In function canSplitFunctionOn() of ir_modifications.cpp, there is a possible out of bounds read due to a heap buffer o… |
CVE-2021-27241 | Medium | 6.1 | 2021-03-29 | This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (Build 20.8.5653.561)… |
CVE-2020-25289 | Medium | 5.5 | 2020-09-13 | The VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary files via an Object Manager symbolic link from the log directo… |
CVE-2020-15024 | Medium | 5.5 | 2020-09-10 | An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. An entered password continues to be s… |
CVE-2020-13657 | Medium | 5.5 | 2020-06-29 | An elevation of privilege vulnerability exists in Avast Free Antivirus and AVG AntiVirus Free before 20.4 due to improperly handling hard links. The vulnerabil… |
CVE-2020-10868 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to l… |
CVE-2020-10867 | Critical | 9.8 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to b… |
CVE-2020-10866 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to e… |
CVE-2020-10865 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to m… |
CVE-2020-10864 | Medium | 6.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to t… |
CVE-2020-10863 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to t… |
CVE-2020-10862 | High | 7.8 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to a… |
CVE-2020-10861 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to a… |
CVE-2020-10860 | High | 7.5 | 2020-04-01 | An issue was discovered in Avast Antivirus before 20. An Arbitrary Memory Address Overwrite vulnerability in the aswAvLog Log Library results in Denial of Serv… |
CVE-2020-8987 | High | 7.4 | 2020-03-09 | Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-mi… |
CVE-2020-9399 | Medium | 5.5 | 2020-02-28 | The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Ant… |
CVE-2019-17190 | High | 7.8 | 2020-01-27 | A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpd… |
CVE-2019-18894 | High | 7.8 | 2020-01-13 | In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Ban… |
CVE-2019-18893 | Medium | 6.1 | 2020-01-13 | XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code… |
CVE-2019-18653 | Medium | 6.1 | 2019-11-01 | A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notif… |
CVE-2019-17093 | High | 7.8 | 2019-10-23 | An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\sys… |
CVE-2019-11230 | Medium | 4.4 | 2019-07-18 | In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing the Logs\Update.log file with a symlink… |
CVE-2018-12572 | High | 7.8 | 2019-03-21 | Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive information by dumping Avast… |
CVE-2017-8308 | High | 7.5 | 2017-04-27 | In Avast Antivirus before v17, an unprivileged user (and thus malware or a virus) can mark an arbitrary process as Trusted from the perspective of the Avast pr… |
CVE-2017-8307 | Critical | 9.8 | 2017-04-27 | In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replac… |
CVE-2017-5567 | Medium | 6.7 | 2017-03-21 | Code injection vulnerability in Avast Premier 12.3 (and earlier), Internet Security 12.3 (and earlier), Pro Antivirus 12.3 (and earlier), and Free Antivirus 12… |
CVE-2016-4025 | Medium | 5.5 | 2016-11-03 | Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoin… |
CVE-2015-8620 | High | 7.8 | 2016-04-13 | Heap-based buffer overflow in the Avast virtualization driver (aswSnx.sys) in Avast Internet Security, Pro Antivirus, Premier, and Free Antivirus before 11.1.2… |
CVE-2016-3986 | High | 7.8 | 2016-04-12 | Avast allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted PE file, related to authentico… |
CVE-2015-5662 | | 2015-10-18 | Directory traversal vulnerability in Avast before 150918-0 allows remote attackers to delete or write to arbitrary files via a crafted entry in a ZIP archive. | |
CVE-2013-0122 | | 2013-04-22 | The avast! Mobile Security application before 2.0.4400 for Android allows attackers to cause a denial of service (application crash) via a crafted application… | |
CVE-2010-3126 | | 2010-08-26 | Untrusted search path vulnerability in avast! Free Antivirus version 5.0.594 and earlier allows local users, and possibly remote attackers, to execute arbitrar… | |
CVE-2010-0705 | | 2010-02-25 | Aavmker4.sys in avast! 4.8 through 4.8.1368.0 and 5.0 before 5.0.418.0 running on Windows 2000 and XP does not properly validate input to IOCTL 0xb2d60030, whi… | |
CVE-2009-4049 | | 2009-11-23 | Heap-based buffer overflow in aswRdr.sys (aka the TDI RDR driver) in avast! Home and Professional 4.8.1356.0 allows local users to cause a denial of service (m… | |
CVE-2009-3524 | | 2009-10-01 | Unspecified vulnerability in ashWsFtr.dll in avast! Home and Professional for Windows before 4.8.1356 has unknown impact and local attack vectors. | |
CVE-2009-3523 | | 2009-10-01 | aavmKer4.sys in avast! Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1) 0xb2d6000c and (2) 0xb2d60034, which al… | |
CVE-2009-3522 | | 2009-10-01 | Stack-based buffer overflow in aswMon2.sys in avast! Home and Professional for Windows 4.8.1351, and possibly other versions before 4.8.1356, allows local user… | |
CVE-2008-6846 | | 2009-07-02 | Multiple stack-based buffer overflows in avast! Linux Home Edition 1.0.5, 1.0.5-1, and 1.0.8 allow remote attackers to cause a denial of service (application c… | |
CVE-2008-5523 | | 2008-12-12 | avast! antivirus 4.8.1281.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ… | |
CVE-2008-1625 | | 2008-04-02 | aavmker4.sys in avast! Home and Professional 4.7 for Windows does not properly validate input to IOCTL 0xb2d60030, which allows local users to gain privileges… | |
CVE-2007-6265 | | 2007-12-07 | Unspecified vulnerability in avast! 4 Home and Professional Editions before 4.7.1098 allows remote attackers to have an unknown impact via a crafted TAR archiv… | |
CVE-2007-2845 | | 2007-05-24 | Heap-based buffer overflow in the CAB unpacker in avast! Anti-Virus Managed Client before 4.7.700 allows user-assisted remote attackers to execute arbitrary co… | |
CVE-2007-1673 | | 2007-05-09 | unzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a ZOO archiv… | |
CVE-2007-1672 | | 2007-05-09 | avast! antivirus before 4.7.981 allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to… |