Avast vulnerabilities
86 vulnerabilities
Known vulnerabilities in Avast products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 39 products.
Products
39- Antivirus33 vulnerabilities
- Avast Antivirus11 vulnerabilities
- Free Antivirus9 vulnerabilities
- Avast Antivirus Home8 vulnerabilities
- Avast Antivirus Professional8 vulnerabilities
- Premium Security6 vulnerabilities
- Cleanup Premium5 vulnerabilities
- Avast Internet Security3 vulnerabilities
- Avg Antivirus3 vulnerabilities
- Avast2 vulnerabilities
- Internet Security2 vulnerabilities
- Premier2 vulnerabilities
- Pro Antivirus2 vulnerabilities
- Secure Browser2 vulnerabilities
- Anitvirus1 vulnerabilities
- Antitrack1 vulnerabilities
- Antivirus For Linux1 vulnerabilities
- Antivirus Pro1 vulnerabilities
- Antivirus Pro Plus1 vulnerabilities
- Avast Antivirus Free1 vulnerabilities
- Avast Business Antivirus1 vulnerabilities
- Avast Free Antivirus1 vulnerabilities
- Avast\! Mobile Security1 vulnerabilities
- Avast Premier1 vulnerabilities
- Avast Pro Antivirus1 vulnerabilities
- Avast Secureline1 vulnerabilities
- Avg Antitrack1 vulnerabilities
- Business Security1 vulnerabilities
- Cleanup1 vulnerabilities
- Email Server Security1 vulnerabilities
- Endpoint Protection1 vulnerabilities
- Endpoint Protection Plus1 vulnerabilities
- Endpoint Protection Suite1 vulnerabilities
- Endpoint Protection Suite Plus1 vulnerabilities
- File Server Security1 vulnerabilities
- (Free/Premiium/Ultimeat) Antivirus1 vulnerabilities
- Retdec1 vulnerabilities
- Script Shield1 vulnerabilities
- Secureline Vpn1 vulnerabilities
CVE-2018-12572avastfree_antivirus
EPSS score0.31%
Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain sensitive information by dumping AvastUI.exe application memory and parsing the data.CVE-2013-0122avastavast\!_mobile_securityEPSS score0.36%
The avast! Mobile Security application before 2.0.4400 for Android allows attackers to cause a denial of service (application crash) via a crafted application that sends an intent to com.avast.android.mobilesecurity.app.scanner.DeleteFileActivity with zero arguments.CVE-2021-27241avastpremium_securityEPSS score0.27%
This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (Build 20.8.5653.561). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the AvastSvc.exe module. By creating a directory junction, an attacker can abuse the service to delete a directory. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12082.CVE-2021-45339avastantivirusEPSS score0.33%
Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted process which could lead to the bypassing of Avast self-defense.CVE-2021-45337avastantivirusEPSS score0.45%
Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain elevated privileges by "hollowing" process wsc_proxy.exe which could lead to acquire antimalware (AM-PPL) protection.CVE-2021-45338avastantivirusEPSS score0.39%
Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessarily powerful internal methods of the main antivirus service which could lead to the (1) arbitrary file delete, (2) write and (3) reset security.CVE-2021-45336avastantivirusEPSS score0.47%
Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated privileges by using system IPC interfaces which could lead to exit the sandbox and acquire SYSTEM privileges.CVE-2021-45335avastantivirusEPSS score0.39%
Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefore evade detection or delete arbitrary system files.CVE-2015-5662avastavast_antivirusEPSS score2.97%
Directory traversal vulnerability in Avast before 150918-0 allows remote attackers to delete or write to arbitrary files via a crafted entry in a ZIP archive.CVE-2015-8620avastavast_free_antivirus+3EPSS score0.50%
Heap-based buffer overflow in the Avast virtualization driver (aswSnx.sys) in Avast Internet Security, Pro Antivirus, Premier, and Free Antivirus before 11.1.2253 allows local users to gain privileges via a Unicode file path in an IOCTL request.CVE-2007-2845avastavast_antivirusEPSS score6.28%
Heap-based buffer overflow in the CAB unpacker in avast! Anti-Virus Managed Client before 4.7.700 allows user-assisted remote attackers to execute arbitrary code via a crafted CAB archive, resulting from an "integer cast around".CVE-2007-2846avastavast_antivirusEPSS score7.74%
Heap-based buffer overflow in the SIS unpacker in avast! Anti-Virus Managed Client before 4.7.700 allows user-assisted remote attackers to execute arbitrary code via a crafted SIS archive, resulting from an "integer cast around."CVE-2007-1673amavisamavis+10EPSS score3.18%
unzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.CVE-2007-1672avastavast_antivirusEPSS score3.18%
avast! antivirus before 4.7.981 allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.CVE-2007-6265avastavast_antivirus_home+1EPSS score1.34%
Unspecified vulnerability in avast! 4 Home and Professional Editions before 4.7.1098 allows remote attackers to have an unknown impact via a crafted TAR archive.CVE-2016-4025avastbusiness_security+10EPSS score0.40%
Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email Server Security v8.x.x allow attackers to bypass the DeepScreen feature via a DeviceIoControl call.CVE-2016-3986avastavastEPSS score7.88%
Avast allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted PE file, related to authenticode parsing.CVE-2025-13032avastantivirus+3EPSS score0.25%
Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflow.CVE-2025-71326avastavast_antivirusEPSS score0.18%
AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with elevated SYSTEM privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables that execute with high-level system permissions.CVE-2025-4134avastavast business antivirusEPSS score0.21%
Lack of file validation in do_update_vps in Avast Business Antivirus for Linux 4.5 on Linux allows local user to spoof or tamper with the update file via an unverified file write.