PT-2026-22806 · Avira · Avira Internet Security

Quarkslab · Published 2026-03-03 · Updated 2026-03-13 · CVE-2026-27748

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avira Internet Security (affected versions not specified)

Description An improper link resolution issue exists in the Software Updater component of Avira Internet Security. The Software Updater, running with SYSTEM privileges, deletes a file located at C:ProgramData without verifying if the path is a symbolic link or reparse point. A local attacker can create a malicious link to redirect the deletion to an arbitrary file, potentially leading to the deletion of attacker-selected files with SYSTEM privileges. This could result in local privilege escalation, denial of service, or compromise of system integrity, depending on the targeted file and operating system setup.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

DoS

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-27748

Affected Products

Avira Internet Security

References · 14

• 🔥 https://blog.quarkslab.com/avira-deserialize-delete-and-escalate-the-proper-way-to-use-an-av.html · Exploit
• https://gendigital.com/us/en/contact-us/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27748 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27748 · Vendor Advisory
• https://avira.com/en/internet-security · Note
• https://t.me/cveNotify/154427 · Telegram Post
• https://reddit.com/r/avira/comments/1rkcq1e/avira_users_beware_another_antivirus_another · Reddit Post
• https://support.avira.com/hc/en-us/articles/360010656158-Current-Avira-versions · Note
• https://reddit.com/r/antivirus/comments/1rkcofi/avira_users_beware_another_antivirus_another · Reddit Post
• https://twitter.com/vuldb/status/2029739140858978740 · Twitter Post
• https://t.me/cveNotify/155379 · Telegram Post
• https://t.me/CVEtracker/46447 · Telegram Post
• https://twitter.com/quarkslab/status/2028857066421395816 · Twitter Post
• https://vulncheck.com/advisories/avira-internet-security-arbitrary-file-deletion-via-improper-link-resolution · Note