CVE-2026-80301 in Avast Antivirus
Summary
by MITRE • 11/06/2026
Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to access COM interfaces to the Task Scheduler service, escape containment, and execute code with elevated privileges outside the sandbox.
The sandbox virtualizes file system and registry access but does not adequately restrict COM interface access to Task Scheduler. A process inside the sandbox can instantiate COM objects bound to Task Scheduler functionality and invoke methods to schedule and execute tasks on the host system. The Task Scheduler COM pathway is not blocked by the sandbox policy, allowing arbitrary code execution in the host security context.
This escape vector bypasses the sandbox's intended process and file isolation boundaries and can be chained with other host-level privilege escalation techniques.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified as an improper isolation flaw within the Avast antivirus software on Windows operating systems represents a critical failure in virtualization boundary enforcement, specifically concerning Component Object Model (COM) interface restrictions. This security defect allows a local attacker who has achieved low-privileged execution inside the sandboxed environment to bypass containment mechanisms and escalate privileges to the host system level. The core of this vulnerability lies in the incomplete implementation of isolation policies for specific Windows subsystems. While Avast successfully virtualizes file system operations and registry access, creating an illusion of separation between the guest process running within the sandbox and the underlying host operating system, it fails to adequately restrict or intercept COM interface calls directed at critical system services such as Task Scheduler. This oversight creates a direct pathway for malicious code to interact with privileged components that are intended to be inaccessible from untrusted contexts.
From a technical perspective, the flaw exploits the fact that many Windows functionalities rely on COM objects rather than direct file I/O or registry reads. The sandbox policy appears to have been configured to block standard API calls and file system interactions but neglected to implement hooks or filters for specific COM interfaces associated with task management. Consequently, an attacker executing code within the constrained environment can instantiate COM objects bound to Task Scheduler functionality. By invoking methods exposed by these objects, such as creating new tasks or modifying existing ones, the malicious process effectively communicates directly with the host's service control manager. This interaction is not intercepted or denied by the sandbox engine because it falls outside the scope of the monitored virtualized resources. The result is that commands issued from inside the sandbox are executed on the host system under the security context of the Avast service itself, which typically runs with elevated privileges such as SYSTEM level access.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and lateral movement within a compromised environment. An attacker who has managed to execute arbitrary code inside the sandbox can leverage this flaw to escape containment entirely. Once outside the sandbox boundaries, the attacker gains control over the host operating system with high-level privileges. This capability allows for the installation of persistent backdoors, modification of security settings, theft of sensitive data stored on the host file system, and further exploitation of other local vulnerabilities that require higher access rights. The ability to schedule tasks means the attacker can ensure their malicious payload persists across reboots or executes at specific times, complicating detection and remediation efforts by standard endpoint protection tools that may not monitor scheduled task creation from within sandboxed processes as aggressively as they do direct file system modifications.
This vulnerability aligns with CWE-250, which describes execution with unnecessary privileges, and CWE-693, Protection Mechanism Failure, specifically regarding the failure to enforce isolation boundaries between trusted and untrusted code domains. In terms of offensive security frameworks, this technique maps directly to MITRE ATT&CK T1053 Scheduled Task/Job, where attackers use scheduled tasks for persistence or privilege escalation, as well as T1027 Obfuscated Files or Information if the initial sandbox escape is part of a larger evasion strategy. The attack vector also relates to T1068 Exploitation for Privilege Escalation, highlighting how internal application flaws can be leveraged to gain higher access levels than initially granted by the operating system's permission model.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Users should immediately update Avast antivirus software to a version where this specific COM interface restriction has been patched. Security administrators should monitor for unusual creation of scheduled tasks, particularly those originating from processes associated with security or virtualization products, as these can serve as indicators of compromise related to sandbox escapes. Implementing application whitelisting policies that restrict the execution of unsigned scripts or binaries within known antivirus directories can provide an additional layer of defense against exploitation attempts. Furthermore, organizations should consider deploying endpoint detection and response solutions capable of monitoring COM object instantiation patterns to detect anomalies indicative of privilege escalation attacks. Future development efforts for sandbox technologies must prioritize comprehensive API hooking strategies that cover not only file system and registry interactions but also complex inter-process communication mechanisms like COM, ensuring that all pathways to privileged services are subject to strict policy enforcement regardless of the interface type used.