Login Request a demo
High severity · published Dec 27, 2021
CVE-2021-45338
Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessarily powerful internal methods of…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessarily powerful internal methods of the main antivirus service which could lead to the (1) arbitrary file delete, (2) write and (3) reset security.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Antivirus · Avast
before 20.4 · source: NVD
Affected product
AN
Antivirus
Avast
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-45338
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-45338
Exploit
https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST1.1
Exploit
https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST1.2
Exploit
https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST1.3
Vendor Advisory
https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast-0
More from Antivirus
9.8
CVE-2025-3500
Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation
9.8
CVE-2020-10867
An issue was discovered in Avast Antivirus before 20
9.8
CVE-2017-8307
In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete…
8.8
CVE-2021-45337
Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain elevated privileges by…
8.8
CVE-2021-45336
Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated privileges by using system IPC…