CVE-2024-13944: avast cleanup Link Following
Vulnerability summary
CVE-2024-13944 is a high (CVSS 7.8) Link Following vulnerability in avast cleanup. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.5% of scored vulnerabilities.
Timeline
- 09-05-2025PublishedVulnerability first disclosed.
- 13-10-2025Last modifiedVulnerability information updated.
Description
Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via the creation of a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
+0.01 pp
From 0.16% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
- CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Affected systems
Avast1 product
- cleanup≤ 24.3.17165.19178
Avg1 product
- tuneup≤ 24.3.17165.10564
Norton1 product
- norton utilities ultimate≤ 24.3.17165.6812
3 vendors · 3 products