{"id":"CVE-2026-82964","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-82964","generatedAt":"2026-10-28T01:47:35.081Z","title":"Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM.","description":"Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM.\n\n\n\nWhen the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES only, omitting WRITE_DAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRP_MJ_CREATE callback additionally did not strip WRITE_DAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM.\n\n\n\nThe absence of an IRP_MJ_SET_SECURITY callback in the driver's operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack.","published":"2026-09-16T15:17:56.000Z","lastModified":"2026-09-17T19:17:05.000Z","status":"Awaiting Analysis","sourceIdentifier":"security@nortonlifelock.com","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"cwe":["CWE-281","CWE-653","CWE-862"],"affected":[],"epss":{"score":0.00157,"percentile":0.04811,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/MSNightmare/PrettyPrague","source":"security@nortonlifelock.com"},{"url":"https://support.avast.com/en-us/article/Update-Antivirus","source":"security@nortonlifelock.com"},{"url":"https://support.avg.com/SupportArticleView?l=en&urlname=Update-AVG-Antivirus","source":"security@nortonlifelock.com"},{"url":"https://support.norton.com/sp/en/us/home/current/solutions/v20240108175512167","source":"security@nortonlifelock.com"},{"url":"https://www.gendigital.com/us/en/contact-us/security-advisories/","source":"security@nortonlifelock.com"},{"url":"https://x.com/msnightmare2000/status/2094106041046765752","source":"security@nortonlifelock.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-82964","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}