CVE-2025-71326: AVAST Antivirus 25.11 Local Privilege Escalation via Unquoted SecureLine Service

Technical summary

CVE-2025-71326 is classified as an unquoted service path vulnerability (CWE-428) in AVAST Antivirus 25.11's SecureLine service. The Windows service configuration does not properly quote the executable path, causing the operating system to search for and execute binaries in parent directories before locating the intended service binary. This path-traversal weakness in service initialization permits local privilege escalation: a low-privileged user can craft an executable name matching a potential path component and position it in a world-writable or user-controlled directory. Upon service restart or startup, Windows executes the attacker's binary with SYSTEM privileges. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local access requirement, low attack complexity, and high impact across confidentiality, integrity, and availability.

Business impact

Successful exploitation grants attackers SYSTEM-level code execution on affected endpoints, enabling data exfiltration, persistent malware installation, ransomware deployment, and lateral movement within the network. Because this vulnerability requires local access but affects a security product (the antivirus itself), a compromised workstation running AVAST 25.11 becomes a beachhead for enterprise-wide compromise. The threat is heightened in environments where standard users have temporary local access or where malware has already achieved user-level execution—the vulnerability then becomes a trivial pivot to full control. Business continuity, data integrity, and compliance (especially in regulated industries) face material risk.

Affected systems

AVAST Antivirus version 25.11 is vulnerable. The vendors_products field in the source data is empty, so assume this affects the specific version identified. Administrators should verify exact product line coverage (e.g., AVAST Free, AVAST Premium, AVAST Business, etc.) against the vendor advisory. Other versions and competitors' products are not confirmed affected by this CVE.

Exploitability

The vulnerability is highly exploitable in practical environments. Exploitation requires only local system access and standard user privileges—no authentication bypass, kernel exploit, or complex techniques needed. Attack complexity is low: an attacker simply creates an executable in a predictable location and waits for the service to restart (or triggers a restart if permissions allow). No user interaction is required; the privilege escalation occurs automatically during service initialization. In scenarios where an attacker has already achieved code execution as a standard user (via phishing, supply-chain malware, or legitimate remote access), this vulnerability becomes a frictionless path to SYSTEM access. However, purely remote attackers without local foothold cannot directly exploit this flaw.

Remediation

Apply the vendor patch immediately. Contact AVAST to identify the specific updated version for 25.11 that addresses the unquoted service path. In parallel, implement compensating controls: restrict local administrative access where feasible, monitor service startup events, and ensure proper NTFS permissions on directories where the service binary resides. If patching is delayed, consider temporarily disabling the SecureLine service if operationally acceptable, though this reduces endpoint protection.

Patch guidance

Obtain the latest security update from AVAST for antivirus version 25.11. Verify the update's release notes explicitly confirm remediation of the unquoted service path in SecureLine. Test the patch in a non-production environment before broad deployment. Ensure all affected systems are updated; staggered rollout is acceptable but all instances should be patched within 48–72 hours given the local privilege escalation severity. Confirm post-patch that the service configuration correctly quotes the executable path by inspecting HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services (SecureLine entry) in the Registry or using Service Management tools. Restart the SecureLine service after patching to activate the fix.

Detection guidance

Monitor Windows Event Viewer for SecureLine service start failures or unexpected restarts, which may indicate exploitation attempts. Search for suspicious executable files with names matching partial path components (e.g., 'SecureLine.exe', 'Secure.exe') in user-writable directories (%TEMP%, user Desktop, Downloads, etc.). Use endpoint detection tools to flag unsigned executables executing with SYSTEM privileges from non-standard paths. Log and alert on Registry modifications to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecureLine. Check file creation timestamps in parent directories around service restart times. Behavioral analysis may catch the privilege escalation chain: low-privilege process creating executables followed by high-privilege process spawning from unusual location.

Why prioritize this

This vulnerability merits immediate priority. It provides local privilege escalation (CVSS 7.8 HIGH) on a security product, meaning successful exploitation undermines the very tool meant to defend the endpoint. The attack surface includes any user with local access—standard employees, remote desktop sessions, or malware already present on the system. The low complexity and high impact (C, I, A all HIGH) leave little room for mitigation short of patching. The absence of KEV status (not yet added to CISA's Known Exploited Vulnerabilities catalog at time of publication) does not diminish urgency; exploit code for unquoted service paths is widely available, and defenders should assume it will be weaponized rapidly.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) is justified by: (1) local attack vector—requires login or physical access; (2) low attack complexity—no special conditions or advanced techniques; (3) low privilege requirement—any standard user can exploit; (4) no user interaction needed; (5) confidentiality, integrity, and availability impacts are HIGH due to unrestricted SYSTEM-level code execution. The score appropriately reflects a severe local privilege escalation but stops short of CRITICAL because purely remote attackers cannot directly exploit without first achieving local foothold. For endpoints already compromised at user level, this effectively enables full system takeover.

Frequently asked questions