CVE-2026-6064: high-severity vulnerability in Gen Digital Norton Antivirus
Norton, Avast, and AVG local privilege escalation via link following in Data Shredder
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3epss 0.1%
Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\SYSTEM privelages.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
Gen Digital · Avast AntivirusGen Digital · AVG Internet SecurityGen Digital · Norton AntivirusRelated CVEs — Gen Digital Norton Antivirus
In the same product, most dangerous first.
CVE-2025-10101HIGHAvast antivirus heap buffer OOB read when scanning a malformed Mach-O fileEPSS 0.2%CVE-2025-7011HIGHAvast antivirus heap OOB when scanning a malformed zip fileEPSS 0.1%CVE-2025-7009HIGHAvast antivirus heap buffer OOB read when scanning a malformed PE fileEPSS 0.1%CVE-2025-7008HIGHAvast antivirus heap buffer OOB read when scanning a malformed PE fileEPSS 0.1%CVE-2025-7004HIGHAvast antivirus heap buffer OOB write when scanning a malformed PE fileEPSS 0.1%CVE-2025-7019MEDIUMAvast antivirus stack overflow when scanning a malformed Office Open XML fileEPSS 0.1%