{"id":"CVE-2026-80302","kind":"vulnerability","aliases":["CVE-2026-80302"],"related":[],"title":"Avast sandbox on Windows lets code escape and write to host files","description":"Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker executing inside the sandbox to write arbitrary files outside sandbox containment and execute code on the host.\n\n\n\nThe sandbox virtualizes file system operations by intercepting write requests to protected system directories. However, the virtualization implementation fails to properly validate write targets in certain edge cases, allowing writes to bypass the virtualization redirection and reach the actual host file system in protected locations.\n\n\n\nAn attacker can exploit this to overwrite executable files, system libraries, or startup configurations with arbitrary content, leading to code execution with host privileges on subsequent system operations or reboot.","summary":"A flaw in the Avast sandbox file virtualization layer on Windows lets a program running inside the sandbox write files outside it. An attacker can overwrite executables, system libraries or startup settings, so code runs with host privileges later.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avast","endpoint","other","windows"],"not_affected_if":["sandbox-not-used"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T16:18:59+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","triaged_at":"2026-11-06T16:44:57+00:00","updated_at":"2026-11-06T16:44:57+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T16:44:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Avast sandbox on Windows lets code escape and write to host files","impact":"high","summary":"A flaw in the Avast sandbox file virtualization layer on Windows lets a program running inside the sandbox write files outside it. An attacker can overwrite executables, system libraries or startup settings, so code runs with host privileges later.","audience":"everyone","category":"other","nicknames":[],"who_cares":["windows","avast","endpoint"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"code runs with host privileges after sandbox escape","analyst_note":"Confirm affected Avast product versions and the fixed build from the vendor advisory; NVD entry alone gives no version ranges.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["sandbox-not-used"],"who_is_affected":"Windows machines running Avast's sandbox feature, where untrusted programs are run inside the sandbox. The sources do not name affected Avast versions or say whether the sandbox must be enabled by a user. Systems without the Avast sandbox in use are unlikely to be exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":4345,"output_tokens":453,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-80302':15A,18A 'actual':135C 'allow':73C,125C 'arbitrari':86C,157C 'attack':46B,79C,143C 'avast':1A,19B,27B,66C 'bypass':128C 'case':124C 'certain':122C 'code':6A,56B,93C,161C 'configur':155C 'contain':90C 'content':158C 'cve':13A,16A 'directori':110C 'edg':123C 'endpoint':20B 'escap':7A 'execut':49B,80C,92C,149C,162C 'exploit':145C 'fail':115C 'file':12A,29B,42B,68C,87C,100C,137C,150C 'flaw':24B 'host':11A,59B,96C,136C,164C 'howev':111C 'implement':114C 'insid':38B,81C 'insuffici':62C 'intercept':104C 'isol':63C 'later':61B 'layer':31B,70C 'lead':159C 'let':5A,34B 'librari':51B,152C 'local':75C 'locat':141C 'low':77C 'low-privileg':76C 'oper':102C,169C 'outsid':43B,88C 'overwrit':48B,148C 'privileg':60B,78C,165C 'program':36B 'proper':117C 'protect':108C,140C 'reach':133C 'reboot':171C 'redirect':131C 'request':106C 'run':37B,57B 'sandbox':2A,28B,40B,67C,83C,89C,98C 'set':54B 'startup':53B,154C 'subsequ':167C 'system':50B,101C,109C,138C,151C,168C 'target':120C 'valid':118C 'virtual':30B,69C,99C,113C,130C 'window':4A,22B,33B,72C 'write':9A,41B,85C,105C,119C,126C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running Avast's sandbox feature, where untrusted programs are run inside the sandbox. The sources do not name affected Avast versions or say whether the sandbox must be enabled by a user. Systems without the Avast sandbox in use are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["avast","endpoint","other","unknown","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-80302':15A,18A 'avast':1A 'code':6A 'cve':13A,16A 'escap':7A 'file':12A 'host':11A 'let':5A 'sandbox':2A 'window':4A 'write':9A","search_b":"'attack':46B 'avast':19B,27B 'code':56B 'endpoint':20B 'execut':49B 'file':29B,42B 'flaw':24B 'host':59B 'insid':38B 'later':61B 'layer':31B 'let':34B 'librari':51B 'outsid':43B 'overwrit':48B 'privileg':60B 'program':36B 'run':37B,57B 'sandbox':28B,40B 'set':54B 'startup':53B 'system':50B 'virtual':30B 'window':22B,33B 'write':41B","search_c":"'actual':135C 'allow':73C,125C 'arbitrari':86C,157C 'attack':79C,143C 'avast':66C 'bypass':128C 'case':124C 'certain':122C 'code':93C,161C 'configur':155C 'contain':90C 'content':158C 'directori':110C 'edg':123C 'execut':80C,92C,149C,162C 'exploit':145C 'fail':115C 'file':68C,87C,100C,137C,150C 'host':96C,136C,164C 'howev':111C 'implement':114C 'insid':81C 'insuffici':62C 'intercept':104C 'isol':63C 'layer':70C 'lead':159C 'librari':152C 'local':75C 'locat':141C 'low':77C 'low-privileg':76C 'oper':102C,169C 'outsid':88C 'overwrit':148C 'privileg':78C,165C 'proper':117C 'protect':108C,140C 'reach':133C 'reboot':171C 'redirect':131C 'request':106C 'sandbox':67C,83C,89C,98C 'startup':154C 'subsequ':167C 'system':101C,109C,138C,151C,168C 'target':120C 'valid':118C 'virtual':69C,99C,113C,130C 'window':72C 'write':85C,105C,119C,126C","first_public_at":"2026-11-06T16:18:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-80302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80302","severity":null,"published_at":"2026-11-06T16:18:59+00:00","modified_at":"2026-11-06T16:18:59+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","fetched_at":"2026-11-06T16:42:42+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}