{"id":"CVE-2026-12067","kind":"vulnerability","aliases":["CVE-2026-12067"],"related":[],"title":"Avast: crafted JSON crashes Windows AvastSvc service via unhandled exceptions","description":"Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.\n\n\n\nThe vulnerability spans multiple handler pathways in the RPC-based native message protocol:\n\n  *  Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries. \n  *  OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception.\n  *  OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation.\n\n\nIn all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.","summary":"Missing exception handlers in the AvastSvc native message dispatcher (ashServ.dll) let a local user crash the Avast service by sending specially crafted JSON messages. The impact described is a denial of service of that Windows service, not code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avast","endpoint","other","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T16:17:55+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","triaged_at":"2026-11-06T16:44:59+00:00","updated_at":"2026-11-06T16:44:59+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T16:44:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Avast: crafted JSON crashes Windows AvastSvc service via unhandled exceptions","impact":"low","summary":"Missing exception handlers in the AvastSvc native message dispatcher (ashServ.dll) let a local user crash the Avast service by sending specially crafted JSON messages. The impact described is a denial of service of that Windows service, not code execution.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","avast","endpoint"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local attacker crashes the Avast service on Windows","analyst_note":"Find affected Avast product versions and a vendor fix for ashServ.dll in the NVD entry or Avast's advisory; the linked HOL Guard record CVE-2026-120678 may cover it.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Affects Windows machines running Avast's AvastSvc service with the vulnerable ashServ.dll component. Exploitation requires a local, unprivileged account on the machine; the sources do not name affected Avast product versions or say how to confirm exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000686,"input_tokens":4428,"output_tokens":486,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-12067':13A,16A '-2026':12A,15A 'absenc':166C 'action':152C 'action-specif':151C 'allow':71C 'around':172C 'ashserv.dll':30B,68C 'attack':75C 'avast':1A,17B,37B 'avastsvc':6A,26B,64C 'base':96C 'block':171C 'boundari':113C 'case':144C 'catch':170C 'caught':149C 'caus':163C 'chain':181C 'check':126C 'code':58B 'common':161C 'convers':175C 'convert':102C,117C,132C 'craft':2A,42B,83C 'crash':4A,35B,77C 'cve':11A,14A 'denial':50B 'describ':47B 'dispatch':29B,67C,159C 'endpoint':18B 'except':10A,22B,61C,112C,129C,146C 'execut':59B 'expos':127C 'field':104C,121C,135C 'handler':23B,62C,90C,101C,116C,131C,154C 'impact':46B 'integ':138C 'json':3A,43B,84C,103C,173C 'let':31B 'local':33B,73C 'log_nmsvc.message':100C 'messag':28B,44B,66C,85C,98C,179C 'miss':21B,60C 'multipl':89C 'nativ':27B,65C,97C,178C 'nmsvc':115C 'openinsz':114C 'openinsz_nmsvc.profile':130C 'origin':120C 'pathway':91C 'process':180C 'profil':134C 'propag':156C 'protocol':99C 'root':162C 'rpc':95C 'rpc-base':94C 'send':40B,81C 'servic':7A,38B,52B,56B,79C 'span':88C 'special':41B,82C 'specif':153C 'string':106C,123C 'three':143C 'tri':169C 'try-catch':168C 'type':108C,125C,174C 'unhandl':9A 'unprivileg':74C 'url':118C 'user':34B 'valid':109C,140C 'via':8A 'vulner':87C 'window':5A,20B,55B,70C 'without':107C,111C,124C,139C","nicknames":[],"mitigations":[],"who_affected":"Affects Windows machines running Avast's AvastSvc service with the vulnerable ashServ.dll component. Exploitation requires a local, unprivileged account on the machine; the sources do not name affected Avast product versions or say how to confirm exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["avast","endpoint","other","unknown","windows"],"campaign_type":null,"search_a":"'-12067':13A,16A '-2026':12A,15A 'avast':1A 'avastsvc':6A 'craft':2A 'crash':4A 'cve':11A,14A 'except':10A 'json':3A 'servic':7A 'unhandl':9A 'via':8A 'window':5A","search_b":"'ashserv.dll':30B 'avast':17B,37B 'avastsvc':26B 'code':58B 'craft':42B 'crash':35B 'denial':50B 'describ':47B 'dispatch':29B 'endpoint':18B 'except':22B 'execut':59B 'handler':23B 'impact':46B 'json':43B 'let':31B 'local':33B 'messag':28B,44B 'miss':21B 'nativ':27B 'send':40B 'servic':38B,52B,56B 'special':41B 'user':34B 'window':20B,55B","search_c":"'absenc':166C 'action':152C 'action-specif':151C 'allow':71C 'around':172C 'ashserv.dll':68C 'attack':75C 'avastsvc':64C 'base':96C 'block':171C 'boundari':113C 'case':144C 'catch':170C 'caught':149C 'caus':163C 'chain':181C 'check':126C 'common':161C 'convers':175C 'convert':102C,117C,132C 'craft':83C 'crash':77C 'dispatch':67C,159C 'except':61C,112C,129C,146C 'expos':127C 'field':104C,121C,135C 'handler':62C,90C,101C,116C,131C,154C 'integ':138C 'json':84C,103C,173C 'local':73C 'log_nmsvc.message':100C 'messag':66C,85C,98C,179C 'miss':60C 'multipl':89C 'nativ':65C,97C,178C 'nmsvc':115C 'openinsz':114C 'openinsz_nmsvc.profile':130C 'origin':120C 'pathway':91C 'process':180C 'profil':134C 'propag':156C 'protocol':99C 'root':162C 'rpc':95C 'rpc-base':94C 'send':81C 'servic':79C 'span':88C 'special':82C 'specif':153C 'string':106C,123C 'three':143C 'tri':169C 'try-catch':168C 'type':108C,125C,174C 'unprivileg':74C 'url':118C 'valid':109C,140C 'vulner':87C 'window':70C 'without':107C,111C,124C,139C","first_public_at":"2026-11-06T16:17:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12067","severity":null,"published_at":"2026-11-06T16:17:55+00:00","modified_at":"2026-11-06T16:17:55+00:00","first_seen_at":"2026-11-06T16:42:41+00:00","fetched_at":"2026-11-06T16:42:41+00:00","note":null}],"documents":[{"id":60321,"url":"https://hol.org/guard/security/cves/CVE-2026-120678-mongo-c-driver-leaks-the-decompressed-reply","title":"HOL Guard record CVE-2026-120678","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}