Loading story…
SentinelLabs disclosed two high-severity local privilege escalation vulnerabilities in the Avast and AVG Anti Rootkit driver, tracked as CVE-2022-26522 and CVE-2022-26523. The flaws affected Avast and AVG Windows products for years and could allow a non-administrator attacker to execute code in kernel mode, disable security tools, overwrite system components, corrupt the operating system, or fully compromise a device.
The researchers said the bugs potentially exposed millions to tens of millions of users and could be used in sandbox escapes, local privilege escalation chains, or as a second-stage component in browser attacks. SentinelLabs reported the issues to Avast in December 2021, and Avast addressed them in version 22.1, which was expected to reach most users through automatic updates; SentinelLabs said it had found no evidence of in-the-wild exploitation at the time of disclosure.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Avast silently fixed the two vulnerabilities in version 22.1 of affected Avast and AVG products, with most users expected to receive the update automatically.
SentinelLabs reported two high-severity privilege escalation vulnerabilities in Avast and AVG’s Anti Rootkit driver, later tracked as CVE-2022-26522 and CVE-2022-26523, to Avast in December 2021.
SentinelLabs disclosed CVE-2022-26522 and CVE-2022-26523, warning they could let non-administrator attackers gain kernel-mode code execution and potentially take over Windows devices. At the time of disclosure, SentinelLabs said it had found no evidence of in-the-wild exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity local privilege escalation flaw tracked as **`CVE-2025-71326`** affects **AVAST Antivirus 25.11** on Windows, allowing a non-privileged local user to potentially execute arbitrary code with **SYSTEM** privileges. The vulnerability stems from an **unquoted service path** in the Avast SecureLine service, `SecureLine`, where the binary path points to `C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe`, creating an opportunity for path hijacking during service execution. The issue was previously documented in a verified **Exploit-DB** entry authored by Milad Karimi (**Ex3ptionaL**) and has now been assigned a CVE and high severity ratings, including **CVSS 4.0 8.5** and **CVSS 3.1 7.8**. Although the flaw is not remotely exploitable and requires local access, successful exploitation could significantly affect confidentiality, integrity, and availability. Recommended mitigation includes quoting the service path, removing unnecessary spaces where possible, and applying vendor fixes or updates when available.
Jun 29, 2026
SentinelLabs reported that **CVE-2021-21551** affected a Dell BIOS update driver preinstalled on a vast number of consumer and enterprise systems, exposing potentially **hundreds of millions of computers** to local privilege escalation. The issue involved multiple flaws in the `dbutil` driver, which could allow an attacker with local access to escalate privileges to kernel mode, bypass security controls, and execute arbitrary code at the highest level of the operating system. Because the vulnerable driver was broadly distributed through Dell firmware update utilities and support tools, the exposure spanned many device models and persisted even after software updates in some environments. The report warned that successful exploitation could enable attackers to disable security products, maintain persistence, and gain deep control over affected endpoints, prompting the need for driver removal, vendor patches, and verification that vulnerable components were fully remediated across fleets.
Jul 12, 2026
Microsoft disclosed multiple Windows local privilege escalation vulnerabilities affecting kernel-level drivers, including **Windows Common Log File System (CLFS) Driver** flaws tracked as `CVE-2023-23376` and `CVE-2023-28252`, as well as a **Windows Cloud Files Mini Filter Driver** flaw tracked as `CVE-2025-62454`. All three issues were classified as **Elevation of Privilege** vulnerabilities in Microsoft's Security Update Guide. The advisories indicate that successful exploitation could allow an attacker who already has access to a target system to gain higher privileges through vulnerable Windows driver components. The affected bugs span separate Windows subsystems but share the same core risk: attackers can abuse low-level driver weaknesses to move from limited access toward more powerful control over compromised machines, reinforcing the need to prioritize Microsoft security updates for Windows kernel and file-system-related components.
Jul 12, 2026