{"id":"CVE-2026-6064","title":"Norton, Avast, and AVG local privilege escalation via link following in Data Shredder","summary":"Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a pr…","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-59"],"vendor":"Gen Digital","product":"Norton Antivirus","affected":["norton_antivirus < 26.5","avast_antivirus < 26.5","avg_internet_security < 26.5"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T10:47:51.974Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-6064","references":[{"url":"https://www.gendigital.com/us/en/contact-us/security-advisories/"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T11:09:40.350Z","slug":"CVE-2026-6064","body":"## Overview\n\nLink following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\\SYSTEM privelages.\n\n## Affected\n\n- `norton_antivirus < 26.5`\n- `avast_antivirus < 26.5`\n- `avg_internet_security < 26.5`\n\n## Remediation\n\nCustomers are advised to upgrade to version >26.5 released on or after May 2026","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}