---
id: "CVE-2026-80302"
page: "https://infrastack.ai/live/CVE-2026-80302"
kind: "vulnerability"
aliases: ["CVE-2026-80302"]
title: "Avast sandbox on Windows lets code escape and write to host files"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["avast", "endpoint", "other", "windows"]
not_affected_if: ["sandbox-not-used"]
published_at: "2026-11-06T16:18:59+00:00"
first_seen_at: "2026-11-06T16:42:42+00:00"
updated_at: "2026-11-06T16:44:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80302", "first_seen_at": "2026-11-06T16:42:42+00:00"}]
exploit_sources: []
---

# Avast sandbox on Windows lets code escape and write to host files

Link for people: https://infrastack.ai/live/CVE-2026-80302 (this .md is for agents)

A flaw in the Avast sandbox file virtualization layer on Windows lets a program running inside the sandbox write files outside it. An attacker can overwrite executables, system libraries or startup settings, so code runs with host privileges later.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-06T16:42:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-80302

## From the sources

Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker executing inside the sandbox to write arbitrary files outside sandbox containment and execute code on the host.



The sandbox virtualizes file system operations by intercepting write requests to protected system directories. However, the virtualization implementation fails to properly validate write targets in certain edge cases, allowing writes to bypass the virtualization redirection and reach the actual host file system in protected locations.



An attacker can exploit this to overwrite executable files, system libraries, or startup configurations with arbitrary content, leading to code execution with host privileges on subsequent system operations or reboot.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_