Executive Summary

CVE-2025-71326 is an unquoted service path vulnerability found in AVAST Antivirus version 25.11, specifically in the SecureLine service.

This vulnerability occurs because the service configuration uses an unquoted binary path, which allows local non-privileged users to execute code with elevated SYSTEM privileges.

Attackers can exploit this by placing malicious executables in directories that appear earlier in the path resolution process, causing the system to run the malicious code with high-level system permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to privilege escalation attacks where local non-privileged users gain SYSTEM-level access.

With SYSTEM privileges, attackers can execute arbitrary code with the highest level of permissions on the affected system.

This can compromise the security and integrity of the system, potentially allowing attackers to install malware, steal sensitive data, or disrupt system operations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the service path configuration of the Avast SecureLine service for unquoted paths. Specifically, look for the SecureLine service binary path which may be unquoted, such as "C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe".

A common method to detect unquoted service paths on Windows is to use the command line to query the service configuration and inspect the ImagePath value.

• Run the following command in an elevated Command Prompt or PowerShell to list services with unquoted paths: sc qc SecureLine
• Alternatively, use PowerShell to find all services with unquoted paths: Get-WmiObject win32_service | Where-Object { $_.PathName -match ' ' -and $_.PathName -notmatch '"' } | Select-Object Name, PathName

If the SecureLine service path is unquoted and contains spaces, it indicates the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, ensure that the service path for the Avast SecureLine service is properly quoted to prevent path hijacking.

If possible, update Avast Antivirus to a version where this vulnerability is fixed.

As a temporary workaround, manually edit the service configuration to add quotes around the binary path or restrict write permissions on directories in the service path to prevent malicious executable injection.

• Use the command: sc config SecureLine binPath= ""C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe"" to set the quoted path.
• Restrict write permissions on the folders in the service path to prevent unprivileged users from placing malicious executables.

Useful 0 Not Useful 0