CVE-2026-107707 in Intego
Summary
by MITRE • 10/08/2026
Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The Intego Antivirus for Windows, specifically versions up through 3.0.0.1, contains a critical security flaw within its optimization module that stems from improper handling of symbolic links or junction points during file system operations. This vulnerability is classified under CWE-59 as Improper Link Resolution Before File Access, commonly known as a link following vulnerability. The core technical issue arises when the antivirus software processes duplicate files for optimization purposes without adequately validating whether the target path resolves to an arbitrary location on the local file system. By failing to enforce strict canonicalization of paths or restrict operations to intended directories, the application inadvertently allows unprivileged users to manipulate the filesystem structure in ways that bypass standard access controls.
The operational impact of this flaw is severe due to the context in which the antivirus software typically operates. Antivirus applications generally run with high privileges, often as the SYSTEM account, to effectively monitor and protect system resources. An attacker who has local unprivileged access can exploit this privilege escalation vector by creating a junction point that redirects a scanned duplicate file's directory path to C:\Config.msi. This specific directory is associated with Windows Installer operations and possesses unique security attributes that allow for rollback procedures when installations fail or are interrupted. By leveraging the antivirus software's tendency to follow links during its optimization routine, an attacker can trick the application into performing actions on this protected system folder under the guise of legitimate file management tasks.
The exploitation strategy involves abusing the Windows Installer rollback mechanism in conjunction with the link following flaw. When the antivirus module processes the redirected path, it may trigger operations that interact with the Windows Installer service. Because C:\Config.msi is a sensitive area managed by the operating system's installation engine, manipulating files here can lead to unintended execution of code or modification of critical system components. Since these actions are performed by the Intego Antivirus process running as SYSTEM, any malicious payload executed through this chain inherits those elevated privileges. This allows an attacker who previously had only limited user rights to achieve full administrative control over the compromised machine, potentially leading to complete data compromise, persistence mechanisms being established, or further lateral movement within a network environment.
This vulnerability aligns with several entries in the MITRE ATT&CK framework, particularly T1059 Command and Scripting Interpreter if script execution is involved, and more critically T1270 Application Access Token which describes abusing application privileges to execute code. It also relates to T1564 Hidden Files and Directories through the use of junction points to obscure malicious activity within standard system directories. The lack of proper input validation regarding filesystem paths represents a fundamental failure in secure coding practices, highlighting the necessity for developers to implement strict path canonicalization and ensure that privileged operations are confined to whitelisted directories without following external symbolic links unless explicitly required and safely validated.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is to apply the vendor-provided patch or update Intego Antivirus to a version later than 3.0.0.1, where this link handling logic has been corrected. In environments where updating is not immediately feasible, administrators should consider restricting file system access for the antivirus service account using Windows Access Control Lists (ACLs) to prevent modification of critical directories like C:\Config.msi by non-administrative processes. Additionally, enabling advanced auditing on sensitive filesystem objects can help detect attempts to create junction points or manipulate symbolic links in protected areas. Developers must also adopt secure coding standards that mandate the use of safe file API functions which do not follow symlinks unless explicitly instructed, and implement rigorous validation checks to ensure all paths resolve within expected application directories before performing any privileged operations.