TOCTOU Vulnerability in Avast and AVG Antivirus for Windows
CVE-2023-1586

6.5MEDIUM

Key Information:

Vendor

Avast

Status
Avast Antivirus
Avg Antivirus
Vendor
CVE Published:
19 April 2023

What is CVE-2023-1586?

Avast and AVG Antivirus for Windows were found to have a Time-of-check/Time-of-use (TOCTOU) vulnerability during the file restoration process. This vulnerability could allow unauthorized users to create arbitrary files, potentially leading to various exploits. The issue has since been addressed in version 22.11 of both Avast and AVG Antivirus, ensuring enhanced security for users.

Affected Version(s)

Avast Antivirus Windows 22.5 <= 22.10

AVG Antivirus Windows 22.5 <= 22.10

References

https://support.norton.com/sp/static/external/tools/secur...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-1586 : TOCTOU Vulnerability in Avast and AVG Antivirus for Windows