Executive brief
Avast Antivirus, a popular security suite for Windows, contains a configuration flaw in its SecureLine VPN service. A local user with limited permissions can exploit this flaw to run malicious programs with full administrative (SYSTEM) privileges. This could allow an attacker who has already gained a foothold on a machine to take complete control of the operating system.
Technical details
An unquoted service path vulnerability (CWE-428) exists in the SecureLine service (VpnSvc.exe) of Avast Antivirus version 25.11 and potentially earlier. The service configuration uses a binary path containing spaces (C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe) without surrounding quotes. A local, non-privileged attacker can exploit this by placing a malicious executable in a parent directory (e.g., C:\Program.exe), which the Windows Service Control Manager will execute instead of the intended binary when the service starts. Successful exploitation results in arbitrary code execution with SYSTEM privileges.
Affected products
- Avast AVAST Antivirus <= 25.11
Timeline
- 2025-12-17: other: Initial exploit discovery date reported by researcher
- 2026-04-22: other: Exploit published to Exploit-DB
- 2026-06-19: advisory: NVD publication date