Security News Avira Users beware! Another antivirus 🛡️, another unfulfilled promise 😣. Avira's protection turned into a privilege escalation playground.

[Khushal]

Content source

https://blog.quarkslab.com/avira-deserialize-delete-and-escalate-the-proper-way-to-use-an-av.html

Three vulnerabilities in Avira Internet Security, from an arbitrary file delete primitive to two distinct paths to SYSTEM privileges.


3 LPE vectors via symlink abuse (CVE-2026-27748, CVE-2026-27750) and unsafe deserialization (CVE-2026-27749).

Disclosure Timeline​

Below we include a timeline of all the relevant events during the coordinated vulnerability disclosure process with the intent of providing transparency to the whole process and our actions.

• 2025-10-25: Quarkslab sent mail to cert@gendigital.com (parent company of Avira) asking for a contact to report vulnerabilities over email. Quarkslab wrote: "we are aware of your vulnerability reporting web page but would like to report via email because your web form requires us to agree to your bug bounty platform's terms and conditions, which includes clauses Quarkslab cannot accept".
• 2025-10-25: Quarkslab's opened a bug report on Gendigital's bug bounty platform (Bugcrowd) with the same text as in the email.
• 2025-10-28: Quarkslab's sent mail to security@avira.com asking for a contact to report vulnerabilities over email, explaning why it could not submit the report over the bug bounty platform.
• 2025-10-29: Gendigital replied over email stating that it is their policy to only accept vulnerabilities through their published bug bounty program and that any issue submitted to them outside of those established programs will not be acknowledged in any manner.
• 2025-10-30: Quarkslab replied quoting the exact clause from the Terms of the bug bounty program considered problematic and not acceptable: "ALL SUBMISSIONS ARE CONFIDENTIAL INFORMATION OF THE PROGRAM OWNER UNLESS OTHERWISE STATED IN THE BOUNTY BRIEF. This means no submissions may be publicly disclosed at any time unless the Program Owner has otherwise consented to disclosure". Quarkslab explained that we could not agree to give up the right to publish our research work on our own terms, and therefore we could not use their bug bounty program to report the vulns. However, if Gendigital gave us explicit written approval to publish our research, including all relevant technical details without any editorial interference, after 90 calendar days of the initial reporting date, we would gladly submit the report on the bug bounty platform. We hoped Gendigital would understand our position and agree to the proposed compromise solution.
• 2025-11-05: Gendigital replied that they are "committed to coordinated public disclosure of reported, valid security findings and in recognizing and awarding that work. Publishing reviewed and approved information once the issue is resolved with a timeline that allows customers appropriate time to update. Properly reported and resolved issues are also recognized with a Common Vulnerabilities and Exposures (CVE) reports, as well as monetary awards aligned with the severity of the report" and that they "believe these are fair and appropriate actions that recognize the efforts of security researchers while ensuring our customers are properly protected", and looked forward to reviewing and working with Quarkslab to resolve any reported issues.
• 2025-11-18: Quarkslab replied that Gendigigal had indicated that the only way to report vulnerabilities was via their bug bounty platform but we explained that the Terms of Service of their program were not acceptable. We clarified that we were not interested in monetary rewards and simply wanted to report the vulns so they could get fixed but could not do it if that also implied giving up the right to publish our work. Quarkslab explained that imposing that requirement is neither fair not appropriate. Our proposal was that the vendor explicitly accepted publication of any vulnerability report submitted on the bug bounty platform in 90 calendar days since the date of the initial report but unfortunately the response was just a generic statement about their commitment to coordinated vulnerability disclosure, not an actual response to what we proposed. Therefore Quarkslab wrote that it would refrain from submitting vulnerability reports via the bug bounty platform.
• 2025-12-02: Gendigital replied that if Quarkslab wanted to report vulnerabilities to please do and they'd be glad to work with us on disclosure of issues in due time, but that unfortunately they could not agree to any terms that tie a fix or report to an arbitrary timeline, and nor will they commit to publishing information they’ve not reviewed. The vendor stated "We also do not commit to publishing dates as we want to ensure adequate time for users to upgrade to fixed versions before we make any information or details public. Our first commitment is to our user's safety, and we’ll continue to hold to that commitment. We’re not trying to prevent publishing, and we’re not trying to hide information. We’ve worked with many researchers to publish responsibly under this program, and we hope you will join that list".
• 2025-12-03: Quarkslab agreed that Gendigital's decision was unfortunate indeed because we could not agree to terms of of a bug bounty program that required submission under NDA and they stated that they would only receive and service vulnerability reports if they are sent through their bug bounty. Thus we were in a deadlock. To break out of the deadlock Quarkslab sent the vulnerability report in PDF format over email and explicitly noted that it was not a submission to the bug bounty program and we did not agree to its terms. Quarkslab did not agree to any restrictions on the publication of the research work that originated the report or its results. We stated that following the industry's common practice, we had set the deadline for publication of the vulnerabilities in the report, and any other work derived from our own self-funded research that uncovered them, to March 3rd 2026, 90 calendar days from today, which was considered the date of initial report. Quarkslab also suggested that if the vendor's first commitment was to their user's safety they should consider removing from their program the requirement to submit vulnerability reports under NDA. Such a practice is frown upon by many vulnerability researchers and vulnerability research organizations, as explained by Kendra Albert in her "Everything Old Is New Again: Legal Restrictions on Vulnerability Disclosure on Bug Bounty Platforms" talk at the 34th Usenix Security Symposium in 2025. Quarkslab also noted that we've reported vulnerabilities to many vendors worldwide for over a decade and worked with them following Coordinated Vulnerability Disclosure practices ("Responsible Disclosure" is a term originally coined by Microsoft and deprecated in 2010 after they realized it was biased). Over that entire period Quarsklab very rarely encountered vendors that only serviced vulnerability reports if they were submitted via a program bound by an NDA agreement. We hope that the vendor reconsiders such practice.
• 2026-02-25: Requesting CVE at VulnCheck.
• 2026-02-25: CVE-2026-27748,CVE-2026-27749 and CVE-2026-27750 has been reserved by VulnCheck.
• 2026-03-03: This blog post is published.

Avira: Deserialize, Delete and Escalate - The Proper Way to Use an AV - Quarkslab's blog

Three vulnerabilities in Avira Internet Security, from an arbitrary file delete primitive to two distinct paths to SYSTEM privileges.

blog.quarkslab.com

 

[Zero Knowledge]

It's good bugs are disclosed and fixed, I don't mind bugs being found it means people are looking. Every AV/Am probably has tens of vulnerabilities in their code base.

 

[Halp2001]

Thanks @Khushal for sharing the news. The irony is that Avira’s red umbrella looks more like it’s full of holes: instead of shielding, it let three critical leaks slip through that allow file deletion and privilege escalation. An umbrella that doesn’t protect from the storm ends up being more decorative than useful. Luckily Quarkslab decided to speak up, because thanks to them the flaws are now known.

 

[Khushal]

It's good bugs are disclosed and fixed, I don't mind bugs being found it means people are looking. Every AV/Am probably has tens of vulnerabilities in their code base.

Yeah but the way gen digital handled it was disgraceful.

 

[Zero Knowledge]

Yeah but the way gen digital handled it was disgraceful.

I don't think any company handles serious vulnerabilities in the right way that's why full disclosure was a huge thing in the early 2000's.

Most companies will first try to hide bugs/exploits or pay of the bug hunter researcher with NDAs up the wazoo.

Google/Apple/Firefox is probably thee best example of good disclosure/security practices.

 

[Khushal]

I don't think any company handles serious vulnerabilities in the right way that's why full disclosure was a huge thing in the early 2000's.

Most companies will first try to hide bugs/exploits or pay of the bug hunter researcher with NDAs up the wazoo.

Google/Apple/Firefox is probably thee best example of good disclosure/security practices.

Yeah these vulns also highlight why bloated AVs solutions just don't waste your money but also act as a security risk.

 

[Zero Knowledge]

Yeah these vulns also highlight why bloated AVs solutions just don't waste your money but also act as a security risk.

Usability vs Security. You can do it with in built Windows tools but you will have to spend hours tinkering with whitelists and controls or you can use a AV.

I use ESET because it makes it easy and cuts down hours of wasted time. Also you now have Andy Fuls/danb's tools so their is no excuse now.

 

[Wrecker4923]

Synopsis of the timeline posted above:

Quarkslab encountered significant difficulties in reporting vulnerabilities to Gendigital due to restrictive terms in the company's bug bounty program, which required non-disclosure of submissions, starting on Oct 25, 2025. Despite multiple attempts to negotiate terms that would allow for eventual publication of their findings, without the reward from the program, Gendigital insisted on using its bug bounty platform exclusively. Unable to reach a compromise, Quarkslab ultimately submitted the vulnerability report via email, explicitly stating it was not a submission under the bug bounty terms, while setting a publication deadline for March 3, 2026.

 

[Miravi]

Perpetual confidentiality restrictions aren't universal, but it is increasingly common as described in the talk mentioned in the above article, "Everything Old Is New Again: Legal Restrictions on Vulnerability Disclosure on Bug Bounty Platforms." Nondisclosure is the standard policy on Bugcrowd, which is used by both Gen Digital and Bitdefender.

Other notable companies relying on Bugcrowd include OpenAI, Motorola, NETGEAR, and Barracuda Networks. They do significant work around products that affect countless people while imposing similar restrictions.

I hope that can change. Gen Digital made it more restrictive than the former Avast, but they're following the overall direction taken by many other companies.

Given the nature of antiviruses, I think it's safe to assume that similar software vulnerabilities lurk in the rest of the competitors, too. I just happened to choose Avast recently because it's lighter than Defender and considered reasonably effective by intelligent people, although I'm not married to it.

Windows, Linux, Chrome, Firefox, Outlook, LibreOffice, Call of Duty, PDFs, JPEGs, and antiviruses all open vulnerabilities on your computer. That's just the reality of complex software.