CVE-2026-80301
Received
Received - Intake
Sandbox Escape via Task Scheduler COM Interface in Avast
Vulnerability report for CVE-2026-80301, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-06
Last updated on: 2026-11-06
Assigner: NortonLifeLock Inc.
Description
Description
Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to access COM interfaces to the Task Scheduler service, escape containment, and execute code with elevated privileges outside the sandbox.
The sandbox virtualizes file system and registry access but does not adequately restrict COM interface access to Task Scheduler. A process inside the sandbox can instantiate COM objects bound to Task Scheduler functionality and invoke methods to schedule and execute tasks on the host system. The Task Scheduler COM pathway is not blocked by the sandbox policy, allowing arbitrary code execution in the host security context.
This escape vector bypasses the sandbox's intended process and file isolation boundaries and can be chained with other host-level privilege escalation techniques.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Gen Digital | Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate | From 0 (inc) to 26.7 (exc) |
| Gen Digital | AVG Antivirus Free, AVG Internet Security, AVG Ultimate | From 0 (inc) to 26.7 (exc) |
| Gen Digital | Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced | From 0 (inc) to 26.7 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-653 | The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions. |
| CWE-280 | The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. |
