Skip to content
Fencer Vulns
no cvss —

CVE-2026-80301 json

Avast sandbox escape via unpreserved COM pathway through Task Scheduler

published 2026-11-06 2 d ago modified 2026-11-06 2 d ago also EUVD-2026-118331

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits
0
none known

Summary

Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to access COM interfaces to the Task Scheduler service, escape containment, and execute code with elevated privileges outside the sandbox.

The sandbox virtualizes file system and registry access but does not adequately restrict COM interface access to Task Scheduler. A process inside the sandbox can instantiate COM objects bound to Task Scheduler functionality and invoke methods to schedule and execute tasks on the host system. The Task Scheduler COM pathway is not blocked by the sandbox policy, allowing arbitrary code execution in the host security context.

This escape vector bypasses the sandbox's intended process and file isolation boundaries and can be chained with other host-level privilege escalation techniques.

Patch / fix

  • Gen Digital Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate 26.7
  • Gen Digital AVG Antivirus Free, AVG Internet Security, AVG Ultimate 26.7
  • Gen Digital Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced 26.7

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

Affected products

  • Gen Digital Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate
  • Gen Digital AVG Antivirus Free, AVG Internet Security, AVG Ultimate
  • Gen Digital Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced

Classification

Weakness
  • CWE-280 Improper Handling of Insufficient Permissions or Privileges
  • CWE-653 Improper Isolation or Compartmentalization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.