CVE-2026-82964
Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys
Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM. When the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES only, omitting WRITE_DAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRP_MJ_CREATE callback additionally did not strip WRITE_DAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM. The absence of an IRP_MJ_SET_SECURITY callback in the driver's operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack.
- Affected
- Gen Digital · Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security · AVG Antivirus Free, AVG Internet Security, AVG Ultimate · Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced
- CVSS v3.1 NORTONLIFELOCK
- 8.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- 0.16% chance of exploitation in the next 30 days, 4th percentile
- Published
- 2026-09-16
- Updated
- 2026-09-17
Proof-of-concept exploits (1)
- MSNightmare/PrettyPrague0★ · 2026-08-30