High severity · published Oct 28, 2026
CVE-2026-6064
Norton, Avast, and AVG local privilege escalation via link following in Data Shredder
New
7.3
CVSS
–
EPSS
No
On KEV
Description
Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\SYSTEM privelages.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
AVG Internet Security · Gen Digital
before 26.5 · source: vendor
AA
Avast Antivirus · Gen Digital
before 26.5 · source: vendor
NA
Norton Antivirus · Gen Digital
before 26.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6064
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6064
www.gendigital.com
https://www.gendigital.com/us/en/contact-us/security-advisories/
More from Avast Antivirus
7.8
CVE-2025-7011
Avast antivirus heap OOB when scanning a malformed zip file
7.8
CVE-2025-7009
Avast antivirus heap buffer OOB read when scanning a malformed PE file
7.8
CVE-2025-7008
Avast antivirus heap buffer OOB read when scanning a malformed PE file
7.8
CVE-2025-7004
Avast antivirus heap buffer OOB write when scanning a malformed PE file
5.5
CVE-2025-7019
Avast antivirus stack overflow when scanning a malformed Office Open XML file