CVE-2024-13962: Link Following Local Privilege Escalation Vulnerability in Avast Cleanup Premium Version 24.2.16593.17810

High severity · published May 9, 2025

CVE-2024-13962

Link Following Local Privilege Escalation Vulnerability in Avast Cleanup Premium Version 24.2.16593.17810

7.8

CVSS

0.2%

EPSS

On KEV

Description

Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Gen Digital Inc. Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 13% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CleanUp Premium · Avast

24.2.16593.17810 · source: vendor

In the news

VulnerabilityHigh

ZDI-26-567: Norton Utilities Ultimate NortonUtilitiesSvc Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Norton Utilities Ultimate. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-13962.

CVE-2024-13962

Aug 13, 2026·Zero Day Initiative

Affected product

CleanUp Premium

Avast

All CleanUp Premium CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-13962

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-13962

www.gendigital.com

https://www.gendigital.com/us/en/contact-us/security-advisories/