Skip to content
Fencer Vulns
no cvss —

CVE-2026-12067 json

AvastSvc denial of service via unhandled JsonCpp exceptions in native message handlers

published 2026-11-06 3 d ago modified 2026-11-06 3 d ago also EUVD-2026-118327

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 4%
public exploits
0
none known

Summary

Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.

The vulnerability spans multiple handler pathways in the RPC-based native message protocol:

* Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries.  * OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception. * OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation.

In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.

Patch / fix

  • Gen Digital Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security 26.7
  • Gen Digital AVG Antivirus Free, AVG Internet Security, AVG Ultimate 26.7
  • Gen Digital Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced 26.7

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

Affected products

  • Gen Digital Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security
  • Gen Digital AVG Antivirus Free, AVG Internet Security, AVG Ultimate
  • Gen Digital Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced

Classification

Weakness
  • CWE-248 Uncaught Exception
  • CWE-391 DEPRECATED: Unchecked Error Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.