Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\SYSTEM privelages.
Fix
Vendor advisories in the News 1
- ZDI-26-832: AVG Internet Security avgToolsSvc Link Following Local Privilege Escalation Vulnerability Zero Day Initiative: published advisories · 2026-10-28
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 5
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-28 10:47
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-28 15:21
- StatusReceived → PublishedNVD modified 2026-10-28 10:47
- StatusPublished → ReceivedNVD modified 2026-10-28 11:17
- First seenCVSS 7.3 · gen digitalNVD modified 2026-10-28 10:47
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.