Critical severity · published Apr 1, 2020
CVE-2020-10867
An issue was discovered in Avast Antivirus before 20
9.8
CVSS
2.2%
EPSS
No
On KEV
Description
An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to bypass intended access restrictions on tasks from an untrusted process, when Self Defense is enabled.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Antivirus · Avast
before 20.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10867
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10867
Release Notes
https://forum.avast.com/index.php?topic=232420.0
Release Notes
https://forum.avast.com/index.php?topic=232423.0
Exploit
https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md
More from Antivirus
9.8
CVE-2025-3500
Integer Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: from 25.1.981.6 before 25.3
9.8
CVE-2017-8307
In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete…
8.8
CVE-2021-45337
Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain elevated privileges by…
8.8
CVE-2021-45336
Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated privileges by using system IPC…
8.8
CVE-2021-45335
Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefore evade detection or…