# CVE-2026-80302: Avast sandbox file virtualization escape on Windows

Source: https://junglewise.ai/threats/cve-2026-80302-insufficient-isolation-in-the-avast-sandbox-file-virtualization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-80302 · Severity: info · Published 2026-11-06

Avast Antivirus on Windows contains a sandbox intended to isolate potentially risky software and prevent it from harming the system. A low-privileged user running code inside this sandbox can bypass the isolation to write and modify files in protected system directories on the host computer. This could allow an attacker to replace system files or startup programs with malicious versions, gaining full control of the computer.

Technologies: [Avast Antivirus](https://junglewise.ai/threats/technologies/avast-antivirus-1). Vendors: [Avast](https://junglewise.ai/threats/vendors/avast).

## Quick answers

**Is CVE-2026-80302 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80302 being exploited in the wild.

**How severe is CVE-2026-80302?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** Avast Antivirus.

**Is there a fix for CVE-2026-80302?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-80302 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-80302?** Check whether you run Avast Antivirus. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Avast's file virtualization layer which intercepts write requests to protected directories; however, it fails to properly validate write targets in certain edge cases, allowing writes to bypass redirection and reach the actual host file system. An attacker with code execution inside the sandbox can exploit this to overwrite executable files, system libraries, or startup configurations, achieving code execution with host privileges. The vulnerability requires the attacker to already have code execution within the sandbox environment.

## Affected products

- Avast Antivirus

## Timeline

- 2026-11-06: disclosed

## References

- [https://support.avast.com/en-us/article/Update-Antivirus](https://support.avast.com/en-us/article/Update-Antivirus)
- [https://support.avg.com/SupportArticleView?l=en&urlname=Update-AVG-Antivirus](https://support.avg.com/SupportArticleView?l=en&urlname=Update-AVG-Antivirus)

## Related threats

- [Avast sandbox sandbox escape via COM interface in Task Scheduler](https://junglewise.ai/threats/cve-2026-80301-improper-isolation-in-the-avast-sandbox-on-windows-allows-a-local)
- [Avast Antivirus denial of service in AvastSvc message dispatcher](https://junglewise.ai/threats/cve-2026-12067-missing-exception-handlers-in-avastsvc-native-message-dispatcher)
- [Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate…](https://junglewise.ai/threats/cve-2025-13032-double-fetch-in-sandbox-kernel-driver-in-avast-avg-antivirus-25-3)