Loading story…
A high-severity local privilege escalation flaw tracked as CVE-2025-71326 affects AVAST Antivirus 25.11 on Windows, allowing a non-privileged local user to potentially execute arbitrary code with SYSTEM privileges. The vulnerability stems from an unquoted service path in the Avast SecureLine service, SecureLine, where the binary path points to C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe, creating an opportunity for path hijacking during service execution.
The issue was previously documented in a verified Exploit-DB entry authored by Milad Karimi (Ex3ptionaL) and has now been assigned a CVE and high severity ratings, including CVSS 4.0 8.5 and CVSS 3.1 7.8. Although the flaw is not remotely exploitable and requires local access, successful exploitation could significantly affect confidentiality, integrity, and availability. Recommended mitigation includes quoting the service path, removing unnecessary spaces where possible, and applying vendor fixes or updates when available.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-71326 was published as a high-severity local privilege escalation vulnerability affecting AVAST Antivirus 25.11. The CVE describes the same unquoted service path issue in the SecureLine service and assigns CVSS 4.0 and 3.1 scores of 8.5 and 7.8, respectively.
Exploit-DB published a verified local Windows exploit entry describing an unquoted service path vulnerability in AVAST Antivirus 25.11's SecureLine service that could let a non-privileged user gain SYSTEM privileges. The entry was authored by Milad Karimi (Ex3ptionaL) and did not list a CVE identifier.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelLabs disclosed two high-severity local privilege escalation vulnerabilities in the Avast and AVG Anti Rootkit driver, tracked as **CVE-2022-26522** and **CVE-2022-26523**. The flaws affected Avast and AVG Windows products for years and could allow a non-administrator attacker to execute code in kernel mode, disable security tools, overwrite system components, corrupt the operating system, or fully compromise a device. The researchers said the bugs potentially exposed millions to tens of millions of users and could be used in sandbox escapes, local privilege escalation chains, or as a second-stage component in browser attacks. SentinelLabs reported the issues to Avast in December 2021, and Avast addressed them in version **22.1**, which was expected to reach most users through automatic updates; SentinelLabs said it had found no evidence of in-the-wild exploitation at the time of disclosure.
Jun 29, 2026
Newly documented vulnerabilities in **Spy Emergency build 23.0.205** and **sheed AntiVirus 2.3** allow local attackers to escalate privileges to **`LocalSystem`** through **unquoted service path** flaws classified as **`CWE-428`**. The affected services are **`SpyEmrgHealth`** and **`SpyEmrgSrv`** in Spy Emergency, and **`ShavProt`** in sheed AntiVirus. In each case, a low-privileged user can place a malicious executable in a path segment that Windows may incorrectly parse because the service executable path is not enclosed in quotes. If the vulnerable service is restarted or the host is rebooted, Windows can execute the attacker-controlled binary with **SYSTEM-level** privileges, creating a high-impact local privilege escalation path affecting confidentiality, integrity, and availability. The issues are tracked as **`CVE-2016-20056`** for Spy Emergency and **`CVE-2016-20061`** for sheed AntiVirus, with both records referencing vendor resources, **Exploit-DB**, and **VulnCheck** advisories.
Jun 29, 2026
Newly published CVEs detail **unquoted service path** vulnerabilities in two IObit products that can let a low-privileged local attacker gain **`LocalSystem`** execution. **CVE-2016-20055** affects **IObit Advanced SystemCare 10.0.2**, specifically the `AdvancedSystemCareService10` service, while **CVE-2016-20059** affects **IObit Malware Fighter 4.3.1** through the `IMFservice` and `LiveUpdateSvc` services. Both issues are classified as **CWE-428** and carry high-severity CVSS v3.1 and v4.0 ratings reflecting potential impact to confidentiality, integrity, and availability. In both cases, an attacker with local access can place a malicious executable in a vulnerable service path and wait for the affected service to restart or for the system to reboot, at which point the payload may run with elevated privileges. The Malware Fighter entry cites supporting references including IObit product pages, an **Exploit-DB** listing, and a **VulnCheck** advisory, while both CVEs were recorded through disclosures submitted to **disclosure@vulncheck.com**.
Jun 29, 2026