CVE-2026-27748— Avira Internet Security Arbitrary File Deletion via Improper Link Resolution

Avira Internet Security Arbitrary File Deletion via Improper Link Resolution

Avira Internet Security contains an improper link resolution vulnerability in the Software Updater component. During the update process, a privileged service running as SYSTEM deletes a file under C:\\ProgramData without validating whether the path resolves through a symbolic link or reparse point. A local attacker can create a malicious link to redirect the delete operation to an arbitrary file, resulting in deletion of attacker-chosen files with SYSTEM privileges. This may lead to local privilege escalation, denial of service, or system integrity compromise depending on the targeted file and operating system configuration.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

在文件访问前对链接解析不恰当(链接跟随)

Avira Internet Security 安全漏洞

Avira Internet Security是德国Avira公司的一款网络安全防护软件。 Avira Internet Security存在安全漏洞，该漏洞源于Software Updater组件存在链接解析不当问题，可能导致本地攻击者删除任意文件，进而引发本地权限提升、拒绝服务或系统完整性破坏。

N/A

N/A