CVE-2026-27750

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2026-27750", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-02-23T21:38:48.842Z", "datePublished": "2026-03-05T14:15:23.095Z", "dateUpdated": "2026-04-01T14:38:35.968Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e", "shortName": "GEN", "dateUpdated": "2026-04-01T14:38:35.968Z"}, "title": "Avira Internet Security Optimizer TOCTOU", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "A time-of-check to time-of-use condition allows a directory identified during scanning to be replaced with a junction or reparse point before a separate privileged deletion phase, redirecting deletion to an unintended location."}]}, {"descriptions": [{"lang": "en", "value": "Successful exploitation may delete protected files or directories and can lead to local privilege escalation, denial of service, or system integrity compromise depending on the affected target."}]}], "affected": [{"vendor": "Gen Digital Inc.", "product": "Avira Internet Security", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "1.1.109.1990", "versionType": "semver"}, {"status": "unaffected", "version": "1.1.114.3113", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:avira:avira_internet_security_suite:*:*:*:*:*:windows:*:*", "versionEndIncluding": "1.1.109.1990", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifies directories for cleanup during a scan phase and subsequently deletes them during a separate cleanup phase without revalidating the target path. A local attacker can replace a previously scanned directory with a junction or reparse point before deletion occurs, causing the privileged process to delete an unintended system location. This may result in deletion of protected files or directories and can lead to local privilege escalation, denial of service, or system integrity compromise depending on the affected target.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifies directories for cleanup during a scan phase and subsequently deletes them during a separate cleanup phase without revalidating the target path. A local attacker can replace a previously scanned directory with a junction or reparse point before deletion occurs, causing the privileged process to delete an unintended system location. This may result in deletion of protected files or directories and can lead to local privilege escalation, denial of service, or system integrity compromise depending on the affected target.</p>"}]}], "references": [{"url": "https://support.avira.com/hc/en-us/articles/360010656158-Current-Avira-versions", "tags": ["release-notes"]}, {"url": "https://www.avira.com/en/internet-security", "tags": ["product"]}, {"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "Upgrade Avira Internet Security for Windows to version 1.1.114.3113 or later. Apply updates through the product's built-in updater or a fresh install from the vendor; see the release-notes reference in this record for current supported versions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade Avira Internet Security for Windows to version 1.1.114.3113 or later. Apply updates through the product's built-in updater or a fresh install from the vendor; see the release-notes reference in this record for current supported versions.</p>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T18:17:35.645224Z", "id": "CVE-2026-27750", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:17:44.243Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27750", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-06T18:17:35.645224Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:17:38.584Z"}}], "cna": {"title": "Avira Internet Security Optimizer TOCTOU", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Quarkslab"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Gen Digital Inc.", "product": "Avira Internet Security", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.109.1990"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://blog.quarkslab.com/avira-deserialize-delete-and-escalate-the-proper-way-to-use-an-av.html", "tags": ["technical-description", "exploit"]}, {"url": "https://support.avira.com/hc/en-us/articles/360010656158-Current-Avira-versions", "tags": ["release-notes"]}, {"url": "https://www.avira.com/en/internet-security", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/avira-internet-security-optimizer-toctou", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifies directories for cleanup during a scan phase and subsequently deletes them during a separate cleanup phase without revalidating the target path. A local attacker can replace a previously scanned directory with a junction or reparse point before deletion occurs, causing the privileged process to delete an unintended system location. This may result in deletion of protected files or directories and can lead to local privilege escalation, denial of service, or system integrity compromise depending on the affected target.", "supportingMedia": [{"type": "text/html", "value": "Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifies directories for cleanup during a scan phase and subsequently deletes them during a separate cleanup phase without revalidating the target path. A local attacker can replace a previously scanned directory with a junction or reparse point before deletion occurs, causing the privileged process to delete an unintended system location. This may result in deletion of protected files or directories and can lead to local privilege escalation, denial of service, or system integrity compromise depending on the affected target.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:avira:avira_internet_security_suite:*:*:*:*:*:windows:*:*", "vulnerable": true, "versionEndIncluding": "1.1.109.1990"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-27T20:07:59.717Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27750", "state": "PUBLISHED", "dateUpdated": "2026-03-27T20:07:59.717Z", "dateReserved": "2026-02-23T21:38:48.842Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-03-05T14:15:23.095Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Avira Internet Security", "vendor": "Gen Digital Inc.", "versions": [{"lessThanOrEqual": "1.1.109.1990", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.1.114.3113", "versionType": "semver"}]}], "source": "security@nortonlifelock.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:avira:internet_security:*:*:*:*:*:windows:*:*", "matchCriteriaId": "DFB6EFB7-8777-4A9B-9A00-2FBEE12A7090", "versionEndExcluding": "1.1.114.3113", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifies directories for cleanup during a scan phase and subsequently deletes them during a separate cleanup phase without revalidating the target path. A local attacker can replace a previously scanned directory with a junction or reparse point before deletion occurs, causing the privileged process to delete an unintended system location. This may result in deletion of protected files or directories and can lead to local privilege escalation, denial of service, or system integrity compromise depending on the affected target."}, {"lang": "es", "value": "Avira Internet Security contiene una vulnerabilidad de tiempo de comprobaci\u00f3n y tiempo de uso (TOCTOU) en el componente Optimizer. Un servicio con privilegios que se ejecuta como SYSTEM identifica los directorios que deben limpiarse durante una fase de an\u00e1lisis y, posteriormente, los elimina durante una fase de limpieza independiente sin volver a validar la ruta de destino. Un atacante local puede sustituir un directorio escaneado previamente por un punto de uni\u00f3n o de rean\u00e1lisis antes de que se produzca la eliminaci\u00f3n, lo que provoca que el proceso con privilegios elimine una ubicaci\u00f3n del sistema no deseada. Esto puede dar lugar a la eliminaci\u00f3n de archivos o directorios protegidos y puede provocar una escalada de privilegios locales, una denegaci\u00f3n de servicio o un compromiso de la integridad del sistema, dependiendo del objetivo afectado."}], "id": "CVE-2026-27750", "lastModified": "2026-06-17T10:27:37.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security@nortonlifelock.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27750", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T18:17:35.645224Z", "version": "2.0.3"}}]}, "published": "2026-03-05T15:16:12.153", "references": [{"source": "security@nortonlifelock.com", "tags": ["Release Notes"], "url": "https://support.avira.com/hc/en-us/articles/360010656158-Current-Avira-versions"}, {"source": "security@nortonlifelock.com", "tags": ["Product"], "url": "https://www.avira.com/en/internet-security"}, {"source": "security@nortonlifelock.com", "url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"}], "sourceIdentifier": "security@nortonlifelock.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "security@nortonlifelock.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.1.109.1990]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Avira Internet Security", "source": "cna", "vendor": "Gen Digital Inc."}, "product": "avira_internet_security", "vendor": "gen_digital"}], "analysis": {"en": {"generated_at": "2026-04-16T12:23:38.673465+00:00", "value": {"mitigation_remediation": ["Upgrade Avira Internet Security to version 1.1.114.3113 or newer using the built\u2011in updater or by installing a fresh copy from the vendor.", "Avoid creating junctions or reparse points in directories that the Avira optimizer will scan until the product is patched.", "Monitor system logs for unexpected deletions and review the optimizer's cleanup behavior after the update to ensure the issue is resolved."], "summary": {"action": "Immediate Patch", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Gen Digital Inc.\u2019s Avira Internet Security Suite for Windows versions older than 1.1.114.3113 is affected. The vulnerability exists in the Optimizer component and can be triggered on any Windows installation running the vulnerable product.", "description_and_impact": "Avira Internet Security includes a TOCTOU flaw within its Optimizer module. The privileged cleanup service, running as SYSTEM, first scans the file system and records directories slated for removal, then deletes them in a second phase without re\u2011validating the actual path. A local user can replace a scanned directory with a junction or reparse point before the delete step, causing the privileged process to erase an unintended target. The result can be deletion of protected files or directories, which may grant the attacker elevated privileges, cause data loss, or destabilize the system. This defect corresponds to CWE\u2011367.", "risk_and_exploitability": "The severity rating of the issue is 7.8 on the standard scale, and the estimated public exploitation probability is below one percent. It is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker only needs local, non\u2011privileged access to create a junction or reparse point in a directory that the optimizer will later delete. When the privileged cleanup runs, the attacker can initiate unintended deletion of critical system files, potentially raising privileges or causing denial of service. Despite the low exploitation probability, the high impact of accidental deletion mandates an urgent response."}}}}, "created": "2026-03-06T15:07:39.033415+00:00", "updated": "2026-04-16T12:30:06.115443+00:00", "vendors": ["gen_digital", "gen_digital$PRODUCT$avira_internet_security"]}