CVE-2026-27749 Avira Internet Security System Speedup Insecure Deserialization
Local attackers can achieve SYSTEM-level code execution by exploiting insecure deserialization in the System Speedup component of Avira Internet Security.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27749?
CVE-2026-27749 is a high-severity unsafe deserialization vulnerability in Gen Digital Inc. Avira Internet Security, published on 5 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.exe process, which runs with SYSTEM privileges, deserializes data from a file located in C:\\ProgramData using .NET BinaryFormatter without implementing input validation or deserialization safeguards. Because the file can be created or modified by a local user in default configurations, an attacker can supply a crafted serialized payload that is deserialized by the privileged process, resulting in arbitrary code execution as SYSTEM.
Weakness: CWE-502
Which versions are affected by CVE-2026-27749?
It affects 1 product.
Products include Avira Internet Security.
How do I fix CVE-2026-27749?
No fix has been published for CVE-2026-27749 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-27749 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27749 exists.
Other vulnerabilities in Gen Digital Inc. Avira Internet Security
Sources
Also known as GHSA-w8px-r6g2-r3wp.