AVG Data Shredder Privilege Escalation Flaw Rated CVSS 7.3

On October 28, 2026, TrendAI Zero Day Initiative published advisory ZDI-26-832, documenting a vulnerability in the avgToolsSvc service of AVG Internet Security. The flaw, tracked as CVE-2026-6064, enables local privilege escalation to SYSTEM through symbolic link abuse during deletion operations. The official CVE record assigns a CVSS score of 7.3 HIGH.

The Flaw Mechanism: When the SYSTEM Service Follows the Wrong Link

The avgToolsSvc service runs with SYSTEM privileges on Windows. According to the ZDI advisory, the service fails to properly validate symbolic link resolution before executing folder deletions.

A local attacker with limited privileges creates a symbolic link in a controlled location. When the avgToolsSvc service attempts to delete content via the Data Shredder, it follows the link and operates on files or directories the attacker could not otherwise reach. This technique is classified as CWE-59: Improper Link Resolution Before File Access.

The ZDI advisory describes the consequence: the attacker can "escalate privileges and execute arbitrary code in the context of SYSTEM." Once the appropriate symbolic link is created, the service itself performs the operation with its maximum privileges.

Vulnerability Scope: AVG and Brands Listed in the CVE Record

The ZDI-26-832 advisory title focuses on "AVG Internet Security avgToolsSvc Link Following Local Privilege Escalation Vulnerability." The official CVE record broadens the scope: the CVE title is "Norton, Avast, and AVG local privilege escalation via link following in Data Shredder," and the text specifies the vulnerability affects "Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows."

The ZDI advisory does not mention Norton or Avast in its body text, limiting coverage to AVG. The CVE record indicates the Data Shredder is the common vulnerable component but does not clarify whether the three products use the exact same binary code or variants of the same flaw. The source does not specify the technical relationship between the products.

"This vulnerability allows local attackers to escalate privileges on affected installations of AVG Internet Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability." — TrendAI Zero Day Initiative, Advisory ZDI-26-832

Timeline and CVSS Score

Initial vendor notification was dated April 9, 2026. Coordinated release occurred on October 28, 2026. The CVE record assigns a score of 7.3 HIGH, with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

The vector indicates local attack (AV:L), low complexity (AC:L), low privileges required (PR:L), user interaction required (UI:R). Impact is maximum for confidentiality, integrity, and availability (C:H/I:H/A:H), but scope is unchanged (S:U). The UI:R component — user interaction required — indicates the exploit is not fully automatic; the source does not specify the exact nature of this interaction.

The ZDI advisory does not explicitly state the CVSS score in its text; the figure comes exclusively from the official CVE record.

Remediation

The fixed version is identified in the CVE record: AVG Internet Security 26.5.10933 or later on Windows. For systems running Norton Antivirus or Avast Antivirus, the CVE record indicates these products also fall within the vulnerability scope via the Data Shredder component; the ZDI advisory does not provide separate patch identifiers for these brands.

The source does not specify whether the fix is delivered via automatic update or requires manual intervention. It is not documented whether TrendAI released protective filters for its customers prior to coordinated disclosure.

Analysis: The Structural Paradox

The following section is editorial analysis based on known facts, not additional verified sources.

A security tool becomes an attack vector: this is the narrative tension of the documented facts. The Data Shredder, a component for secure data deletion, operates with SYSTEM privileges to function. That same privilege level, combined with insufficient symbolic link validation, creates the attack surface.

The case illustrates a recurring pattern in security software engineering: components requiring deep system access to perform their legitimate function consequently expose greater risks when input validation is incomplete. The avgToolsSvc service is not vulnerable due to a cryptographic defect or faulty network protocol, but due to a missing check on an elementary file system operation: path resolution before deletion.

Closing

CVE-2026-6064 is a high-impact local privilege escalation made possible by an unvalidated interaction between a SYSTEM service and the file system. Its severity lies in the simplicity of the mechanism — a symbolic link — and the power of the compromised execution context. The patch is available; the six-month exposure window documented in the timeline closed with the coordinated release on October 28, 2026.

Sources

• zerodayinitiative.com
• cve.org