CVE-2026-12067
Received
Received - Intake
Denial of Service in Avast Antivirus Service
Vulnerability report for CVE-2026-12067, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-06
Last updated on: 2026-11-06
Assigner: NortonLifeLock Inc.
Description
Description
Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.
The vulnerability spans multiple handler pathways in the RPC-based native message protocol:
* Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries.
* OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception.
* OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation.
In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Gen Digital | Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security | From 0 (inc) to 26.7 (exc) |
| Gen Digital | AVG Antivirus Free, AVG Internet Security, AVG Ultimate | From 0 (inc) to 26.7 (exc) |
| Gen Digital | Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced | From 0 (inc) to 26.7 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-391 | [PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed. |
| CWE-248 | An exception is thrown from a function, but it is not caught. |
