CVE-2026-80303
Received
Received - Intake
Integer Underflow in Avast WFP Stream Parser Causes DoS
Vulnerability report for CVE-2026-80303, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-06
Last updated on: 2026-11-06
Assigner: NortonLifeLock Inc.
Description
Description
An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causing a system crash.
The WFP callout driver processes network stream data and computes length values for packet fragment reassembly. The length calculation does not properly validate input stream sizes against expected boundaries. When processing specially crafted input, the length computation underflows, resulting in allocation or buffer access with an extremely large wrapped-around size value.
The underflow can be triggered remotely via network traffic destined for the filtered port, or locally via crafted data provided to the filtering interface. The resulting memory allocation failure or out-of-bounds access causes a kernel panic and system crash.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Gen Digital | Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate | From 0 (inc) to 26.7 (exc) |
| Gen Digital | AVG Antivirus Free, AVG Internet Security, AVG Ultimate | From 0 (inc) to 26.7 (exc) |
| Gen Digital | Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced | From 0 (inc) to 26.7 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
| CWE-248 | An exception is thrown from a function, but it is not caught. |
