Vulnerability · Published Oct 28, 2026 · Assigned by GEN
CVE-2026-6064Norton, Avast, and AVG local privilege escalation via link following in Data Shredder
High 7.3
In plain English
A high-severity security flaw in Avast Antivirus from Gen Digital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.1%top 97.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\SYSTEM privelages.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Gen Digital | Norton Antivirus | 0 – before 26.5 |
| Gen Digital | Avast Antivirus | 0 – before 26.5 |
| Gen Digital | AVG Internet Security | 0 – before 26.5 |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H