Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Gen Digital Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security — Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N C H H H 8.8 .0016 4.2 —
AFFECTED
Product Versions Fixed
Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security unspecified —
AVG Antivirus Free, AVG Internet Security, AVG Ultimate unspecified —
Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced unspecified —
TIMELINE
Aug 31 Reserved by GEN
Sep 16 Published (CNA: GEN)
Sep 17 EXPLOIT PUBLISHED — CVE-2026-82964 (Gen Digital Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security). Public exploit reference added.
Description
Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM.
When the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES only, omitting WRITE_DAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRP_MJ_CREATE callback additionally did not strip WRITE_DAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM.
The absence of an IRP_MJ_SET_SECURITY callback in the driver's operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack.
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-82964 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
