AVG Internet Security Suffers Local Privilege Escalation Vulnerability
A link following vulnerability in AVG Internet Security's avgToolsSvc component allows local attackers to escalate privileges to SYSTEM.
The Zero Day Initiative has disclosed a local privilege escalation vulnerability affecting AVG Internet Security, identified as ZDI-26-832 and carrying the CVE identifier CVE-2026-6064. This flaw resides within the avgToolsSvc component of the security software.
Exploitation of this vulnerability requires an attacker to first gain the ability to execute low-privileged code on the target system. Once initial access is established, the attacker can then leverage the specific weakness in the avgToolsSvc service. The vulnerability is described as a link following flaw, which can be abused by an attacker to manipulate folder deletions.
By creating a symbolic link, an attacker can trick the avgToolsSvc service into deleting a targeted folder. This manipulation can ultimately lead to the escalation of privileges on the affected system, allowing the attacker to execute arbitrary code with SYSTEM-level permissions. The CVSS score assigned to this vulnerability is 7.3, indicating a high severity.
AVG Internet Security versions prior to version 26.5 are affected by this vulnerability. Users are strongly advised to update their AVG Internet Security installations to version 26.5 or later to remediate this security risk. The vulnerability was initially reported to the vendor on April 9, 2026, and the coordinated public release of the advisory occurred on October 28, 2026.
This vulnerability highlights the ongoing challenges in securing endpoint security software. Even applications designed to protect systems can harbor vulnerabilities that, if exploited, can lead to severe compromise. The ability for a local attacker to gain SYSTEM privileges is a critical threat, as it grants them complete control over the affected machine.
While the vulnerability requires initial local access, it underscores the importance of robust endpoint security and prompt patching. Attackers often chain together multiple vulnerabilities, and a local privilege escalation flaw can be a crucial step in a broader attack chain, allowing them to bypass user-level restrictions and gain deeper access to the system.
Users of AVG Internet Security should ensure their software is up-to-date and consider implementing additional security measures, such as application whitelisting or enhanced monitoring, to mitigate the risk of exploitation. The disclosure serves as a reminder that all software, including security solutions, requires continuous vigilance and timely updates to maintain a strong security posture.