CVE-2026-12067 · Other
NO FIX YET
Missing exception handlers in the AvastSvc native message dispatcher (ashServ.dll) let a local user crash the Avast service by sending specially crafted JSON messages. The impact described is a denial of service of that Windows service, not code execution.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Affects Windows machines running Avast's AvastSvc service with the vulnerable ashServ.dll component. Exploitation requires a local, unprivileged account on the machine; the sources do not name affected Avast product versions or say how to confirm exposure.
Not affected if no-local-untrusted-users
Who cares avast, endpoint, windows
Unknown from the sources.
No fix yet, per the sources.
Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.
The vulnerability spans multiple handler pathways in the RPC-based native message protocol:
In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.