{"id":"CVE-2026-6064","aliases":["EUVD-2026-111873","GHSA-5qpm-4cp9-qch8"],"status":"published","title":"Norton, Avast, and AVG local privilege escalation via link following in Data Shredder","description":"Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\\SYSTEM privelages.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00124,"percentile":0.02158,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-59"],"published":"2026-10-28T10:47:51Z","modified":"2026-11-08T19:24:06Z","products":[{"vendor":"avast","product":"avast antivirus"},{"vendor":"gen digital","product":"avast antivirus"},{"vendor":"gen digital","product":"avg internet security"},{"vendor":"gen digital","product":"norton antivirus"}],"references":[{"url":"https://www.gendigital.com/us/en/contact-us/security-advisories/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6064"},{"url":"https://www.gendigital.com/us/en/contact-us/security-advisories"},{"url":"https://github.com/advisories/GHSA-5qpm-4cp9-qch8"}],"sources":{"cve":[{"id":"CVE-2026-6064","title":"Norton, Avast, and AVG local privilege escalation via link following in Data Shredder","description":"Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\\SYSTEM privelages.","status":"published","published":"2026-10-28T10:47:51.974Z","modified":"2026-11-08T19:24:06.399Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-08T20:44:32.128624Z"}],"euvd":[{"id":"EUVD-2026-111873","description":"Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\\SYSTEM privelages.","status":"published","published":"2026-10-28T10:47:51Z","modified":"2026-11-08T19:24:06Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-08T20:13:56.600577Z"}],"ghsa":[{"id":"GHSA-5qpm-4cp9-qch8","title":"Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus,...","description":"Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\\SYSTEM privelages.","status":"published","published":"2026-10-28T12:31:00Z","modified":"2026-10-28T12:31:01Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:14:34.063838Z"}],"nvd":[{"id":"CVE-2026-6064","description":"Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\\SYSTEM privelages.","status":"published","published":"2026-10-28T11:17:26.707Z","modified":"2026-11-08T20:17:24.857Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-08T22:11:12.121289Z"}]}}