---
id: CVE-2026-82964
title: >-
  Improper preservation of permissions in the Avast sandbox minifilter driver
  (aswSnx.sys) on Windows allows a local, low-privileged attacker executing
  inside the sandbox to escape file isolation and escalate to SYSTEM.




  When the sandbox…
summary: >-
  Improper preservation of permissions in the Avast sandbox minifilter driver
  (aswSnx.sys) on Windows allows a local, low-privileged attacker executing
  inside the sandbox to escape file isolation and escalate to SYSTEM.




  When the sandbox…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-281
  - CWE-653
  - CWE-862
vendor: Gen Digital
product: >-
  Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast
  Business Security
affected:
  - >-
    avast_free_antivirus_avast_one_avast_premium_security_avast_ultimate_avast_business_security
    < 26.8
  - avg_antivirus_free_avg_internet_security_avg_ultimate < 26.8
  - >-
    norton_antivirus_plus_norton_360_standard_norton_360_deluxe_norton_360_advanced
    < 26.8
published: '2026-09-16'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T19:17:05.013'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82964'
references:
  - url: 'https://github.com/MSNightmare/PrettyPrague'
    label: security@nortonlifelock.com
  - url: 'https://support.avast.com/en-us/article/Update-Antivirus'
    label: security@nortonlifelock.com
  - url: >-
      https://support.avg.com/SupportArticleView?l=en&urlname=Update-AVG-Antivirus
    label: security@nortonlifelock.com
  - url: >-
      https://support.norton.com/sp/en/us/home/current/solutions/v20240108175512167
    label: security@nortonlifelock.com
  - url: 'https://www.gendigital.com/us/en/contact-us/security-advisories/'
    label: security@nortonlifelock.com
  - url: 'https://x.com/msnightmare2000/status/2094106041046765752'
    label: security@nortonlifelock.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-17T18:41:32.262077Z'
ingestedAt: '2026-09-16T14:57:28.037Z'
epss: 0.00136
epssPercentile: 0.03431
---

## Overview

Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM.



When the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES only, omitting WRITE_DAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRP_MJ_CREATE callback additionally did not strip WRITE_DAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM.



The absence of an IRP_MJ_SET_SECURITY callback in the driver's operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.