Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Avast/AVG/Norton 26.7: sandbox escapes and WFP stream-parser crash (CVE-2026-80301–80303)

Avast / AVG / Norton antivirus (Gen Digital) on Windows

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

On Nov 6 2026 NVD published three Gen Digital (security@nortonlifelock.com) advisories affecting Avast, AVG and Norton Windows products before 26.7. CVE-2026-80301: the Avast sandbox virtualizes filesystem/registry but does not adequately restrict Task Scheduler COM, so a local low-privileged process inside the sandbox can schedule host tasks and escape to elevated host code execution. CVE-2026-80302: insufficient isolation in sandbox file virtualization lets a sandboxed process write arbitrary files to protected host locations and achieve host code execution. CVE-2026-80303: an integer underflow in the WFP stream parser can crash the system (DoS), triggerable remotely via filtered network traffic or locally. Update Avast/AVG/Norton to 26.7 or later.

Why this severity: Two local sandbox escapes to host code execution plus a remotely triggerable WFP parser crash; fixed in 26.7 across Avast/AVG/Norton Windows SKUs

Started
Nov 6, 2026
CVEs
CVE-2026-80301CVE-2026-80302CVE-2026-80303

Follow this incident

Discuss on X ↗

Affected

  • Avast Antivirus / One / Premium Security / Ultimate before 26.7 (Windows)
  • AVG Antivirus Free / Internet Security / Ultimate before 26.7 (Windows)
  • Norton Antivirus Plus / 360 Standard / Deluxe / Advanced before 26.7 (Windows)

Fixed in

  • 26.7

Timeline1

  1. NVD publishes CVE-2026-80301 (Avast/AVG/Norton sandbox escape via Task Scheduler COM), CVE-2026-80302 (sandbox file-virtualization arbitrary write to host), and CVE-2026-80303 (WFP stream-parser integer underflow DoS), fixed in version 26.7+. Gen Digital is the CVE sourceIdentifier.

Advisories7

Notes & caveats

Primary records are NVD CVE-2026-80301/80302/80303 (sourceIdentifier security@nortonlifelock.com). Gen Digital security-advisories hub and vendor update articles are the remediation links from those records.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo