File Virtualization Flaw in Avast Product Enables Host Code Execution
CVE-2026-80302
Key Information:
What is CVE-2026-80302?
A security flaw in the Avast sandbox file virtualization layer on Windows permits local, low-privileged attackers operating inside the sandbox to write arbitrary files outside its containment. The sandbox is designed to intercept write requests to safeguard system directories, but the implementation lacks adequate validation of write targets. This oversight can lead attackers to bypass the virtualization layer, allowing them to overwrite essential executable files, libraries, or configuration settings on the host system. Consequently, these actions can enable code execution with host privileges during future system operations or reboots, posing significant risk to system integrity.
Affected Version(s)
Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate Windows 0
AVG Antivirus Free, AVG Internet Security, AVG Ultimate Windows 0
Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced Windows 0