CVE-2026-27750

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-27750
Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifies directories for cleanup during a scan phase and subsequently deletes them during a separate cleanup phase without revalidating the target path. A local attacker can replace a previously scanned directory with a junction or reparse point before deletion occurs, causing the privileged process to delete an unintended system location. This may result in deletion of protected files or directories and can lead to local privilege escalation, denial of service, or system integrity compromise depending on the affected target.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://blog.quarkslab.com/avira-deserialize-delete-and-escalate-the-proper-way-to-use-an-av.html Third Party Advisory
https://support.avira.com/hc/en-us/articles/360010656158-Current-Avira-versions Release Notes
https://www.avira.com/en/internet-security Product
https://www.vulncheck.com/advisories/avira-internet-security-optimizer-toctou Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:avira:internet_security:*:*:*:*:*:windows:*:*
History

13 Mar 2026, 01:19

Type Values Removed Values Added
First Time Avira internet Security
Avira
CPE cpe:2.3:a:avira:internet_security:*:*:*:*:*:windows:*:*
References () https://blog.quarkslab.com/avira-deserialize-delete-and-escalate-the-proper-way-to-use-an-av.html - () https://blog.quarkslab.com/avira-deserialize-delete-and-escalate-the-proper-way-to-use-an-av.html - Third Party Advisory
References () https://support.avira.com/hc/en-us/articles/360010656158-Current-Avira-versions - () https://support.avira.com/hc/en-us/articles/360010656158-Current-Avira-versions - Release Notes
References () https://www.avira.com/en/internet-security - () https://www.avira.com/en/internet-security - Product
References () https://www.vulncheck.com/advisories/avira-internet-security-optimizer-toctou - () https://www.vulncheck.com/advisories/avira-internet-security-optimizer-toctou - Third Party Advisory

05 Mar 2026, 23:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

05 Mar 2026, 19:38

Type Values Removed Values Added
Summary
  • (es) Avira Internet Security contiene una vulnerabilidad de tiempo de comprobación y tiempo de uso (TOCTOU) en el componente Optimizer. Un servicio con privilegios que se ejecuta como SYSTEM identifica los directorios que deben limpiarse durante una fase de análisis y, posteriormente, los elimina durante una fase de limpieza independiente sin volver a validar la ruta de destino. Un atacante local puede sustituir un directorio escaneado previamente por un punto de unión o de reanálisis antes de que se produzca la eliminación, lo que provoca que el proceso con privilegios elimine una ubicación del sistema no deseada. Esto puede dar lugar a la eliminación de archivos o directorios protegidos y puede provocar una escalada de privilegios locales, una denegación de servicio o un compromiso de la integridad del sistema, dependiendo del objetivo afectado.

05 Mar 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-05 15:16

Updated : 2026-03-13 01:19

NVD link : CVE-2026-27750

Mitre link : CVE-2026-27750

CVE.ORG link : CVE-2026-27750

JSON object : View

Products Affected

avira

  • internet_security
CWE
CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition