CVE-2026-80302 · Other
NO FIX YET
A flaw in the Avast sandbox file virtualization layer on Windows lets a program running inside the sandbox write files outside it. An attacker can overwrite executables, system libraries or startup settings, so code runs with host privileges later.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Windows machines running Avast's sandbox feature, where untrusted programs are run inside the sandbox. The sources do not name affected Avast versions or say whether the sandbox must be enabled by a user. Systems without the Avast sandbox in use are unlikely to be exposed.
Not affected if sandbox-not-used
Who cares avast, endpoint, windows
Unknown from the sources.
No fix yet, per the sources.
Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker executing inside the sandbox to write arbitrary files outside sandbox containment and execute code on the host.
The sandbox virtualizes file system operations by intercepting write requests to protected system directories. However, the virtualization implementation fails to properly validate write targets in certain edge cases, allowing writes to bypass the virtualization redirection and reach the actual host file system in protected locations.
An attacker can exploit this to overwrite executable files, system libraries, or startup configurations with arbitrary content, leading to code execution with host privileges on subsequent system operations or reboot.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.