A recent public proof-of-concept (PoC) repository has unveiled a significant local privilege escalation zero-day vulnerability within GenDigital’s Avast Antivirus. This vulnerability presents a potential risk by enabling an attacker to extract the Windows Security Account Manager (SAM) database and execute a shell with NT AUTHORITYSYSTEM privileges.
Avast Antivirus Zero-Day PoC
The PoC, available in a GitHub repository named PrettyPrague, identifies a flaw within the Avast Sandbox component. According to the repository’s README, this vulnerability permits an attacker with local execution access to exploit the sandbox’s elevated privileges, allowing them to retrieve the SAM database and gain a full SYSTEM-level command shell.
Operating under SYSTEM privileges grants the highest local access on Windows systems. If confirmed, this vulnerability could enable an attacker to circumvent the privilege boundaries that Avast Antivirus is designed to enforce, effectively transforming the antivirus software from a protective measure into a potential pathway for a complete local takeover.
The Security Account Manager database is crucial, as it houses sensitive local account credentials, including password hashes. Access to the SAM hive can lead to offline password-cracking attempts, credential theft, and lateral movement within an organization using compromised local administrator credentials.
MSNightmare, the researcher behind the repository, asserts that the PoC is compatible with “any version of Avast Antivirus” and has been successfully tested with fully patched versions of Avast and Windows 11 25H2. The repository was last updated on August 30 and contains C and C++ source code, Visual Studio project files, headers, a compiled x64 release directory, and an offreg.lib library.
At this time, the GitHub project does not provide a formal release, CVE identifier, vendor advisory, affected version information, or patch details. The researcher has also indicated that the vulnerability may extend to other GenDigital security products, such as AVG and Norton, although these claims remain unverified until GenDigital confirms the specifics of the affected software and conditions.
The availability of source code and a compiled release directory heightens the urgency for defenders. While public PoCs can expedite independent validation by researchers, they also lower the barrier for threat actors who already possess local access to a Windows endpoint.
The reported vulnerability appears to be a local elevation-of-privilege issue rather than a means for initial access. An attacker would need the ability to execute code on a machine, which could be achieved through various methods, including phishing, malicious downloads, stolen remote-access credentials, exploitation of other vulnerabilities, or misuse of legitimate software.
Security teams are advised to monitor for suspicious child processes initiated by Avast-related services or sandbox components, unexpected command interpreters running under SYSTEM, access to the SAM registry hive, and unusual creation of registry hive dump files. Endpoint telemetry should be scrutinized for unexpected access to HKLMSAM, HKLMSYSTEM, or specific paths linked to registry backup and credential-dumping activities.
Organizations utilizing Avast should conduct an inventory of their deployed versions, restrict local administrator access, prevent unauthorized users from executing binaries on endpoints, and apply any vendor-provided mitigations or updates as soon as they become available. Until an official response is provided, defenders should refrain from assuming that related GenDigital products are vulnerable solely based on preliminary claims in the repository.
Keep your SOC up to date on active malware & phishing within 24 hours of their emergence. Try ANYRUN to prevent incidents with early detection.
