All vulnerabilities
CVE-2026-6064

Norton, Avast, and AVG local privilege escalation via link following in Data Shredder

Gen Digital Norton Antivirus
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in26.5Fixed versionCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\SYSTEM privelages.

Text from CVE List

Affected versions 3

  • Norton Antivirusaffected: all versions before 26.5CVE List
  • Avast Antivirusaffected: all versions before 26.5CVE List
  • AVG Internet Securityaffected: all versions before 26.5CVE List

References 1