# Avast/AVG/Norton 26.7: sandbox escapes and WFP stream-parser crash (CVE-2026-80301–80303) · pwn.watch

> On Nov 6 2026 NVD published three Gen Digital (security@nortonlifelock.com) advisories affecting Avast, AVG and Norton Windows products before 26.7. CVE-2026-80301: the Avast sandbox virtualizes filesystem/registry but does not adequately restrict Task Scheduler COM, so a local low-privileged process inside the sandbox can schedule host tasks and escape to elevated host code execution. CVE-2026-80302: insufficient isolation in sandbox file virtualization lets a sandboxed process write arbitrary files to protected host locations and achieve host code execution. CVE-2026-80303: an integer underflow in the WFP stream parser can crash the system (DoS), triggerable remotely via filtered network traffic or locally. Update Avast/AVG/Norton to 26.7 or later.

Page: https://pwn.watch/i/avast-sandbox-escape-wfp-cve-2026-80301-80303 · generated 2026-11-07T20:22:27.676Z

## Status
- Severity: high · status: live · patch: patched
- Product: Avast / AVG / Norton antivirus (Gen Digital) on Windows
- Started: 2026-11-06
- CVEs: CVE-2026-80301, CVE-2026-80302, CVE-2026-80303
- Affected: Avast Antivirus / One / Premium Security / Ultimate before 26.7 (Windows); AVG Antivirus Free / Internet Security / Ultimate before 26.7 (Windows); Norton Antivirus Plus / 360 Standard / Deluxe / Advanced before 26.7 (Windows)
- Fixed in: 26.7

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/avast-sandbox-escape-wfp-cve-2026-80301-80303/feed.xml
- JSON Feed: https://pwn.watch/i/avast-sandbox-escape-wfp-cve-2026-80301-80303/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/avast-sandbox-escape-wfp-cve-2026-80301-80303.json
- This file: https://pwn.watch/i/avast-sandbox-escape-wfp-cve-2026-80301-80303/llms.txt

## Updates (newest first)
- 2026-11-06: NVD publishes CVE-2026-80301 (Avast/AVG/Norton sandbox escape via Task Scheduler COM), CVE-2026-80302 (sandbox file-virtualization arbitrary write to host), and CVE-2026-80303 (WFP stream-parser integer underflow DoS), fixed in version 26.7+. Gen Digital is the CVE sourceIdentifier. (https://nvd.nist.gov/vuln/detail/CVE-2026-80301)

## Fix brief
# Security brief: Avast/AVG/Norton 26.7: sandbox escapes and WFP stream-parser crash (CVE-2026-80301–80303)

Source: https://pwn.watch/i/avast-sandbox-escape-wfp-cve-2026-80301-80303 · status: live · severity: high · updated Nov 7, 2026, 02:30 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
On Nov 6 2026 NVD published three Gen Digital (security@nortonlifelock.com) advisories affecting Avast, AVG and Norton Windows products before 26.7. CVE-2026-80301: the Avast sandbox virtualizes filesystem/registry but does not adequately restrict Task Scheduler COM, so a local low-privileged process inside the sandbox can schedule host tasks and escape to elevated host code execution. CVE-2026-80302: insufficient isolation in sandbox file virtualization lets a sandboxed process write arbitrary files to protected host locations and achieve host code execution. CVE-2026-80303: an integer underflow in the WFP stream parser can crash the system (DoS), triggerable remotely via filtered network traffic or locally. Update Avast/AVG/Norton to 26.7 or later.

Severity detail: Two local sandbox escapes to host code execution plus a remotely triggerable WFP parser crash; fixed in 26.7 across Avast/AVG/Norton Windows SKUs

- Product: Avast / AVG / Norton antivirus (Gen Digital) on Windows
- CVE / advisory ids: CVE-2026-80301, CVE-2026-80302, CVE-2026-80303

## Affected versions
- Avast Antivirus / One / Premium Security / Ultimate before 26.7 (Windows)
- AVG Antivirus Free / Internet Security / Ultimate before 26.7 (Windows)
- Norton Antivirus Plus / 360 Standard / Deluxe / Advanced before 26.7 (Windows)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 26.7

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Nov 6, 2026: NVD publishes CVE-2026-80301 (Avast/AVG/Norton sandbox escape via Task Scheduler COM), CVE-2026-80302 (sandbox file-virtualization arbitrary write to host), and CVE-2026-80303 (WFP stream-parser integer underflow DoS), fixed in version 26.7+. Gen Digital is the CVE sourceIdentifier.

## Advisories
- [NVD: CVE-2026-80301](https://nvd.nist.gov/vuln/detail/CVE-2026-80301) (NVD)
- [NVD: CVE-2026-80302](https://nvd.nist.gov/vuln/detail/CVE-2026-80302) (NVD)
- [NVD: CVE-2026-80303](https://nvd.nist.gov/vuln/detail/CVE-2026-80303) (NVD)
- [Gen Digital security advisories](https://www.gendigital.com/us/en/contact-us/security-advisories/) (Gen Digital)
- [Update Avast Antivirus](https://support.avast.com/en-us/article/Update-Antivirus) (Avast)
- [Update AVG Antivirus](https://support.avg.com/SupportArticleView?l=en&urlname=Update-AVG-Antivirus) (AVG)
- [Norton product update guidance](https://support.norton.com/sp/en/us/home/current/solutions/v20240108175512167) (Norton)

## Caveats
Primary records are NVD CVE-2026-80301/80302/80303 (sourceIdentifier security@nortonlifelock.com). Gen Digital security-advisories hub and vendor update articles are the remediation links from those records.

---
Machine-readable: https://pwn.watch/i/avast-sandbox-escape-wfp-cve-2026-80301-80303.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.