Executive brief
WatchDog Anti-Virus, a Windows-based security tool that protects computers from malware and threats, installs with overly permissive file permissions in its program directory. This allows any local user with low privileges to modify, replace, or delete antivirus program files and settings. An attacker could disable the antivirus protection entirely or inject malicious code that runs with elevated system privileges, compromising the host's security.
Technical details
The installer grants the Windows Users group Full Control (NTFS permissions) over the entire C:\Program Files (x86)\Watchdog Anti-Virus directory. This privilege escalation vulnerability allows unauthenticated local attackers to replace legitimate binaries or configuration files, which are then executed by privileged WatchDog processes running at system or administrator level. The fix was released in version 1.8.804 on 2026-05-14.
Affected products
- WatchDog Anti-Virus before 1.8.804
Timeline
- 2026-05-14: disclosed: Fixed in version 1.8.804
- 2026-09-20: advisory: CVE-2026-92252 published