CVE-2025-71326: Avast Antivirus

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with elevated SYSTEM privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables that execute with high-level system permissions.

Affected products

• Avast Avast Antivirus: version 25.11 only

Published 2026-06-19. Last modified 2026-10-06.