PT-2026-22807 · Avira · Avira.Systemspeedup.Realtimeoptimizer.Exe+1

Quarkslab · Published 2026-03-03 · Updated 2026-03-13 · CVE-2026-27749

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avira Internet Security (affected versions not specified)

Description The software contains a flaw involving the deserialization of untrusted data within the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.exe process, operating with SYSTEM privileges, deserializes data from a file located at C:ProgramData using .NET BinaryFormatter. This process lacks input validation or deserialization safeguards. An attacker can create or modify this file with a crafted serialized payload, leading to arbitrary code execution with SYSTEM privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-27749

Affected Products

Avira Internet Security

Avira.Systemspeedup.Realtimeoptimizer.Exe

References · 14

• 🔥 https://blog.quarkslab.com/avira-deserialize-delete-and-escalate-the-proper-way-to-use-an-av.html · Exploit
• https://gendigital.com/us/en/contact-us/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27749 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27749 · Vendor Advisory
• https://avira.com/en/internet-security · Note
• https://vulncheck.com/advisories/avira-internet-security-system-speedup-insecure-deserialization · Note
• https://reddit.com/r/avira/comments/1rkcq1e/avira_users_beware_another_antivirus_another · Reddit Post
• https://twitter.com/vuldb/status/2029745932133450058 · Twitter Post
• https://support.avira.com/hc/en-us/articles/360010656158-Current-Avira-versions · Note
• https://reddit.com/r/antivirus/comments/1rkcofi/avira_users_beware_another_antivirus_another · Reddit Post
• https://t.me/cveNotify/154428 · Telegram Post
• https://t.me/cveNotify/155380 · Telegram Post
• https://twitter.com/quarkslab/status/2028857066421395816 · Twitter Post
• https://t.me/CVEtracker/46448 · Telegram Post