Avira Antivirus: Now Featuring Built-In Privilege Escalation

Antivirus software is supposed to stop attackers from gaining control of your system. Avira apparently decided that sometimes it is faster to just give them SYSTEM privileges directly.

Security researchers have identified three high-risk vulnerabilities in Avira's antimalware components that can allow attackers to execute arbitrary code with SYSTEM privileges. In Windows security terms, that’s roughly equivalent to handing someone the master key, the building plans, and the janitor's skeleton key for good measure.

In several cases, exploitation does not require kernel exploits, memory corruption, or particularly creative hacking. Instead, attackers can simply drop files in locations writable by normal users and let the antivirus service, running with maximum privileges, take care of the rest.

Because nothing says security software like doing dangerous things as SYSTEM based on user-controlled files.

A detailed analysis by Quarkslab

It explains the issues here:

https://blog.quarkslab.com/avira-deserialize-delete-and-escalate-the-proper-way-to-use-an-av.html

The vulnerabilities were demonstrated with Avira Free Security, but the affected components are shared with Avira Internet Security and related products, meaning the fun is not limited to the free tier.

Vulnerability #1: Arbitrary File Deletion as a Service

The updater component fails to verify whether a file inside C:\ProgramData is actually a symbolic link. (CVE-2026-27748, CVSS4 8.5, high risk)

An attacker can create a malicious symlink that tricks the updater, running with SYSTEM privileges, into deleting arbitrary files anywhere on the system. In other words, the antivirus updater doubles as a high-privilege file deletion API. That is useful for attackers because deleting the right files can quickly turn normal user into SYSTEM.

Vulnerability #2: Deserialization Without Paranoia

The system speedup component reads serialized data from a file in C:\ProgramData.

Unfortunately, it does so without any validation. Since local users can modify that file by default, attackers can simply replace it with a malicious payload. Once the service processes it, the payload runs with SYSTEM privileges. (CVE-2026-27749, CVSS4 8.5, high risk)

This vulnerability can be exploited locally or remotely via the time-honored technique known as convincing a user to download something.

Vulnerability #3: The TOCTOU Classic

The optimizer component contains a classic time-of-check to time-of-use (TOCTOU) race condition. First, the privileged service scans directories to decide which ones are safe to delete during system cleanup. Later, it performs the deletion. Between those two steps, an attacker can replace the previously scanned directory with a junction or reparse point, redirecting the cleanup operation to arbitrary locations. (CVE-2026-27750, CVSS4 8.5, risk high)

The result: the service happily deletes attacker-chosen files or directories with SYSTEM privileges, of course. Because if your cleanup utility runs as SYSTEM, it might as well clean up whatever the attacker wants removed.

Patch Available

The vulnerabilities affect Avira versions up to 1.1.109.1990. Version 1.1.114.3113 fixes the issues. Users should verify that their installations are up to date.

Anyone using Avira should therefore promptly ensure that the software is indeed up to date.