CVE-2026-6064 in AVG Internet Security
Summary
by MITRE • 10/28/2026
Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\SYSTEM privelages.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability described represents a critical privilege escalation flaw within the data shredding components of several major antivirus suites, specifically Norton Antivirus, Avast Antivirus, and AVG Internet Security on Windows platforms prior to version 26.5.10933. This issue is classified as an improper link following vulnerability that allows local attackers with low privileges to achieve complete system compromise by escalating their access rights to NT AUTHORITY\SYSTEM. The core of the problem lies in how these security applications handle file and folder deletion operations during privileged shred processes, where insufficient validation of symbolic links or junction points enables an attacker to redirect destructive actions toward arbitrary locations on the filesystem rather than the intended target files.
From a technical perspective, this flaw exploits the behavior of Windows API functions that resolve paths before executing high-privilege commands. When the antivirus software initiates a secure deletion routine, it typically runs with elevated system-level permissions to ensure thorough removal of sensitive data. However, if an attacker can manipulate the file path by creating a symbolic link or junction point pointing to a critical system directory or configuration file prior to the shred operation, the privileged process will follow this link and delete or overwrite the target resource instead of the intended user-controlled file. This mechanism bypasses standard access controls because the operating system grants the elevated privileges to the antivirus service, not the original low-privileged user who initiated the request through a potentially malicious interface or script.
The operational impact of this vulnerability is severe, as it effectively neutralizes the security boundary between untrusted users and the core operating system kernel context. By leveraging this flaw, an attacker can delete critical system files, corrupt registry hives, or overwrite configuration files that control startup processes. This capability facilitates a full takeover of the Windows environment, allowing the installation of persistent malware, extraction of sensitive credentials stored in memory or on disk, and complete disruption of service availability. The ability to escalate privileges without authentication requirements makes this vulnerability particularly dangerous in multi-user environments or shared workstations where low-privileged accounts are common.
This issue aligns with Common Weakness Enumeration (CWE) ID 59, which defines Improper Link Resolution Before File Access, and is also associated with CWE 264, Permissions Bypass Using an Alternate Path or Channel. In the context of the MITRE ATT&CK framework, this vulnerability supports techniques related to Privilege Escalation via Trusted Software Bugs (T1068) and potentially Abuse Elevation Control Mechanism (T1548), as it exploits a legitimate administrative function for malicious purposes. The attack vector is local, requiring physical or remote desktop access with low-level user credentials, which places it in the initial access or lateral movement phase depending on the broader compromise scenario.
Mitigation strategies primarily involve applying the vendor-specific patches that address version 26.5.10933 and later for AVG and Avast products, as well as equivalent updates from Norton Antivirus vendors. Until patching is applied, administrators should restrict local user privileges to prevent execution of arbitrary scripts or programs within directories monitored by these antivirus services. Additionally, implementing strict file system auditing can help detect attempts to create symbolic links in sensitive areas where shred operations are likely to occur. Security teams should also consider disabling unnecessary data shredding features if they are not actively required for compliance purposes, thereby reducing the attack surface associated with privileged deletion routines. Regular monitoring of process execution logs for unexpected invocations of antivirus executables by non-administrative users can provide early warning indicators of exploitation attempts in real-time environments.