CVE-2024-5102 Elevation of Privelage via symlinked file in Avast Antivirus
A low-privileged user can exploit a race condition in the repair function to elevate privileges to SYSTEM and execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-5102?
CVE-2024-5102 is a high-severity vulnerability in Avast Antivirus, published on 10 Jun 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A sym-linked file accessed via the repair function in Avast Antivirus <24.2 on Windows may allow user to elevate privilege to delete arbitrary files or run processes as NT AUTHORITY\SYSTEM. The vulnerability exists within the "Repair" (settings -> troubleshooting -> repair) feature, which attempts to delete a file in the current user's AppData directory as NT AUTHORITY\SYSTEM. A low-privileged user can make a pseudo-symlink and a junction folder and point to a file on the system. This can provide a low-privileged user an Elevation of Privilege to win a race-condition which will re-create the system files and make Windows callback to a specially-crafted file which could be used to launch a privileged shell instance.
This issue affects Avast Antivirus prior to 24.2.
Which versions are affected by CVE-2024-5102?
It affects 1 product.
Products include Avast Antivirus.
How do I fix CVE-2024-5102?
No fix has been published for CVE-2024-5102 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-5102 being exploited?
There is no known exploitation of CVE-2024-5102 in the wild and no public exploit code.
Other vulnerabilities in Avast Antivirus
- CVE-2025-13032 Race condition in (Free/Inernet Security/Ultimate) Antivirus
- CVE-2020-10867 Security feature bypass in n/a
- CVE-2017-8307 Missing authorization in n/a
- CVE-2025-3500 Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation
- CVE-2021-45335 Missing authorization in n/a
Sources
Also known as GHSA-75r7-wf67-87f9.