Local Privilege Escalation Vulnerability in Avast Free Antivirus
CVE-2024-7232

7.8HIGH

Key Information:

Vendor

Avast

Status
Free Antivirus
Vendor
CVE Published:
22 November 2024

What is CVE-2024-7232?

A local privilege escalation vulnerability exists in the Avast Free Antivirus due to improper handling of symbolic links within the Avast Service. An attacker with low-privileged access can create a symbolic link to a target directory, allowing for unauthorized deletion of folders. This exploitation enables the attacker to escalate privileges to the SYSTEM level, potentially executing arbitrary code and compromising the integrity and confidentiality of the affected system. Proper safeguards and prompt patching are essential to mitigate risks associated with this vulnerability.

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1004/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.
CVE-2024-7232 : Local Privilege Escalation Vulnerability in Avast Free Antivirus