Avast Antivirus Zero-Day Vulnerability Disclosed with Public Proof-of-Concept
Researcher Chaotic Eclipse has revealed a zero-day privilege escalation vulnerability in Avast Antivirus's sandbox component, with a public proof-of-concept demonstrating SYSTEM-level access.
A significant security vulnerability has been disclosed in Avast Antivirus, potentially allowing attackers to gain SYSTEM-level privileges on affected machines. The zero-day flaw, identified by researcher Chaotic Eclipse under the GitHub handle MSNightmare, targets the Avast Sandbox component, a critical feature designed to isolate suspicious files and prevent malware from impacting the host system.
The vulnerability is described as a privilege escalation flaw that, when exploited, allows an attacker to bypass the sandbox's isolation mechanisms. According to the researcher's public proof-of-concept (PoC) repository, named "PrettyPrague," the exploit can successfully dump the Windows Security Account Manager (SAM) database and spawn a command shell with the highest local security context, NT AUTHORITY\SYSTEM. This level of access is highly coveted by attackers as it grants them extensive control over the operating system.
Exploitation of this vulnerability could have severe consequences. With SYSTEM privileges, an attacker could potentially access and exfiltrate sensitive credentials stored on the machine, disable or tamper with security software like Avast itself, install persistent backdoors for continued access, or modify critical system settings. The PoC reportedly functions on fully patched Avast Antivirus installations and up-to-date Windows 11 25H2 systems, indicating a broad potential impact.
While the researcher claims the PoC is compatible with any version of Avast Antivirus, this assertion has not yet been independently verified by the vendor or through a formal CVE record. The researcher also speculated that other products from GenDigital, Avast's parent company, such as AVG and Norton, might be affected. However, no concrete technical evidence has been provided for these claims, and organizations using those products should treat this aspect as unverified until official assessments are released.
The public release of the PoC, last updated on August 30, 2026, accelerates the timeline for both defenders and potential attackers. Security teams using Avast are advised to closely monitor official advisories from GenDigital. They should also review their endpoint telemetry for any unusual activity, such as unexpected child processes launched by Avast services, suspicious access to the SAM database, or new processes running with SYSTEM privileges without a clear administrative origin.
At present, there is no official CVE number assigned to this vulnerability, nor has GenDigital released a statement or a patch. This means that affected users currently have no official remediation available beyond disabling the affected component or seeking alternative security solutions. The lack of a vendor advisory underscores the zero-day nature of the discovery.
This incident highlights the ongoing challenges in securing endpoint security software, which often operates with high privileges and complex sandboxing mechanisms. The rapid public disclosure of such vulnerabilities, especially with a working exploit, places immediate pressure on vendors to respond and on users to implement detection and mitigation strategies, even in the absence of a formal patch.
Organizations relying on Avast Antivirus should exercise extreme caution and prioritize monitoring for any signs of compromise. The potential for SYSTEM-level access through a sandbox bypass is a critical threat that demands immediate attention from security professionals and the vendor.