Avira
42 CVEs across 40 Avira products. Browse Avira vulnerabilities, severities, and proof-of-concept exploits.
Avira products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27750 | High | 7.8 | 2026-03-05 | Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifi… |
CVE-2026-27749 | High | 7.8 | 2026-03-05 | Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.e… |
CVE-2026-27748 | High | 7.8 | 2026-03-05 | Avira Internet Security contains an improper link resolution vulnerability in the Software Updater component. During the update process, a privileged service r… |
CVE-2024-13759 | High | 7.8 | 2025-05-09 | Local Privilege Escalation in Avira.Spotlight.Service.exe in Avira Prime 1.1.96.2 on Windows 10 x64 allows local attackers to gain system-level privileges via… |
CVE-2023-51636 | High | 7.8 | 2024-05-22 | Avira Prime Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations… |
CVE-2023-36673 | High | 7.3 | 2023-08-09 | An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to th… |
CVE-2023-1900 | High | 7.8 | 2023-04-19 | A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an overflow. This could corrupt the data o… |
CVE-2022-4429 | Medium | 5.3 | 2023-01-10 | Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issu… |
CVE-2022-4294 | High | 7.1 | 2023-01-10 | Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may… |
CVE-2022-3368 | High | 7.3 | 2022-10-17 | A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate hi… |
CVE-2022-28795 | Medium | 6.5 | 2022-04-12 | A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visited a page crafted by an attacker, the… |
CVE-2020-12680 | Medium | 5.5 | 2020-05-08 | Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user credentials. The functions of the executable file Avira.PWM.NativeMessaging.exe… |
CVE-2020-12463 | High | 7.8 | 2020-05-05 | An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users… |
CVE-2020-12254 | High | 7.8 | 2020-04-26 | Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink. |
CVE-2020-8961 | Critical | 9.8 | 2020-04-09 | An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825. The Self-Protection feature does not prohibit a write operation from an external process… |
CVE-2020-9320 | Medium | 5.5 | 2020-02-20 | Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. This affects versions before 8.3.54.138 of Antivirus for Endpoint, A… |
CVE-2013-4602 | Medium | 5.5 | 2020-02-12 | A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF Scanner Engine. |
CVE-2019-18568 | High | 8.8 | 2019-12-31 | Avira Free Antivirus 15.0.1907.1514 is prone to a local privilege escalation through the execution of kernel code from a restricted user. |
CVE-2019-17449 | Medium | 6.7 | 2019-10-10 | Avira Software Updater before 2.0.6.21094 allows a DLL side-loading attack. NOTE: The vendor thinks that this vulnerability is invalid because exploiting it wo… |
CVE-2019-11396 | High | 7.8 | 2019-08-29 | An issue was discovered in Avira Free Security Suite 10. The permissive access rights on the SoftwareUpdater folder (files / folders and configuration) are inc… |
CVE-2016-10402 | High | 7.8 | 2017-07-27 | Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large relative virtual add… |
CVE-2015-7732 | High | 7.5 | 2017-06-15 | The Avira Mobile Security app before 1.5.11 for iOS sends sensitive login information in cleartext. |
CVE-2017-6417 | Medium | 6.7 | 2017-03-21 | Code injection vulnerability in Avira Total Security Suite 15.0 (and earlier), Optimization Suite 15.0 (and earlier), Internet Security Suite 15.0 (and earlier… |
CVE-2015-7303 | | 2015-09-21 | Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header. | |
CVE-2014-5576 | | 2014-09-09 | The Avira Secure Backup (aka com.avira.avirabackup) application 1.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-… | |
CVE-2010-5153 | Medium | 5.3 | 2012-08-25 | Race condition in Avira Premium Security Suite 10.0.0.536 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that… |
CVE-2012-1459 | | 2012-03-21 | The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677… | |
CVE-2012-1457 | | 2012-03-21 | The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender… | |
CVE-2012-1443 | | 2012-03-21 | The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symant… | |
CVE-2012-1425 | | 2012-03-21 | The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, Fortinet Anti… | |
CVE-2009-2761 | | 2009-08-13 | Unquoted Windows search path vulnerability in the scheduler (sched.exe) in Avira AntiVir, AntiVir Premium, Premium Security Suite, and AntiVir Professional mig… | |
CVE-2008-6962 | | 2009-08-13 | Avira AntiVir Premium, Premium Security Suite, AntiVir Professional, and AntiVir Personal - FREE allows local users to execute arbitrary code via a crafted IOC… | |
CVE-2007-2974 | | 2007-06-01 | Buffer overflow in the file parsing engine in Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to execute arbitrary code via a crafted LZH arc… | |
CVE-2007-2973 | | 2007-06-01 | Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed TAR archive. | |
CVE-2007-2972 | | 2007-06-01 | The file parsing engine in Avira Antivir Antivirus before 7.04.00.24 allows remote attackers to cause a denial of service (application crash) via a crafted UPX… | |
CVE-2007-1673 | | 2007-05-09 | unzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a ZOO archiv… | |
CVE-2007-1671 | | 2007-05-09 | avpack32.dll before 7.3.0.6 in Avira AntiVir allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure t… | |
CVE-2006-4619 | | 2006-09-07 | The start update window in update.exe in Avira AntiVir PersonalEdition Classic 7.0 build 151 allows local users to gain system privileges via a "Shatter" style… | |
CVE-2006-1274 | | 2006-03-19 | Classic Planer in AntiVir PersonalEdition Classic 7 does not drop privileges before executing external programs, which allows local users to gain privileges vi… | |
CVE-2005-3224 | | 2005-10-14 | Multiple interpretation error in unspecified versions of AntiVir Antivirus allows remote attackers to bypass virus detection via a malicious executable in a sp… | |
CVE-2005-3219 | | 2005-10-14 | Multiple interpretation error in unspecified versions of Avira Antivirus allows remote attackers to bypass virus detection via a malicious executable in a spec… | |
CVE-2005-2957 | | 2005-09-16 | Stack-based buffer overflow in AVIRA Desktop for Windows 1.00.00.68 with AVPACK32.DLL 6.31.0.3, when archive scanning is enabled, allows remote attackers to ex… |