CVE-2026-82964 in AVG Antivirus Free
Summary
by MITRE • 09/16/2026
Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM.
When the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES only, omitting WRITE_DAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRP_MJ_CREATE callback additionally did not strip WRITE_DAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM.
The absence of an IRP_MJ_SET_SECURITY callback in the driver's operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified within the Avast sandbox minifilter driver, specifically aswSnx.sys on Windows operating systems, represents a critical failure in access control enforcement during file virtualization operations. This flaw allows a local attacker with low privileges who is executing inside the designated sandbox environment to bypass intended isolation mechanisms and achieve full system compromise by escalating privileges to SYSTEM level. The core of this issue lies in how the driver handles security descriptors when creating virtualized copies of files for isolated execution, leading to unintended permission states that undermine the fundamental purpose of the sandboxing technology.
When the minifilter driver virtualizes a file, it is designed to preserve the original security descriptor of the source object to maintain consistency and expected behavior within the simulated environment. However, the implementation contains a significant technical flaw where the driver opens the target object for virtualization using only GENERIC_WRITE and FILE_WRITE_ATTRIBUTES access rights. Crucially, this open operation omits WRITE_DAC access right, which is required to modify discretionary access control lists (DACLs). Consequently, every attempt by the driver to apply or preserve the original DACL on the newly created virtualized file fails silently without raising an error that would halt the process or alert security monitoring systems. This silent failure results in the virtualized copies of sensitive files being left with default permissive permissions rather than their intended restricted state.
The impact of this permission misconfiguration is severe because it exposes critical system data to processes running under low-privileged accounts within the sandbox. Specifically, the absence of proper access restrictions on these virtualized objects allows a malicious actor to read the virtualized copy of the Security Account Manager (SAM) database. By extracting local NTLM password hashes from this accessible file, an attacker can perform offline cracking or pass-the-hash attacks to authenticate as high-privileged users, ultimately executing arbitrary code with SYSTEM-level privileges. This effectively neutralizes the security boundary provided by the sandbox, allowing lateral movement and complete control over the host system.
From a technical architecture perspective, the vulnerability is exacerbated because the IRP_MJ_CREATE callback in the driver does not strip WRITE_DAC permissions for sensitive directories during the creation of virtualized objects. While there is an additional defense-in-depth gap related to the absence of an IRP_MJ_SET_SECURITY callback in the driver's operation registration table, this missing handler is not the primary control preventing the attack; rather, it is a secondary factor that limits further hardening options. The root cause remains the improper handling of access rights during file virtualization and the subsequent failure to enforce restrictive DACLs on sensitive system files.
This vulnerability aligns with CWE-284 Improper Access Control, as the software does not properly restrict permissions for authorized actors, leading to privilege escalation. It also maps to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter through the execution of malicious code after gaining SYSTEM privileges, and potentially T1003 OS Credential Dumping via the extraction of NTLM hashes from the SAM database. Remediation requires updating the Avast software to a version that correctly implements WRITE_DAC access when modifying security descriptors during virtualization or explicitly stripping sensitive permissions for sandboxed contexts. Until patched, administrators should ensure that sandboxed processes are strictly limited in their file system interactions and consider additional host-based intrusion prevention measures to detect attempts to read protected system files like the SAM database from non-standard locations.