--- cve: "CVE-2026-82964" severity: "HIGH" cvss: 8.8 epss: "0.1%" vendor: "Gen Digital" kev: false exploited: false published: "2026-09-16 14:01:47" tags: [cve, security, high] source: tsecurity.de CVE-Dossier exported: "2026-09-21T05:13:40+02:00" --- # CVE-2026-82964 > 8.8 HIGH · đŸ§Ș PoC ## Beschreibung Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM. When the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES only, omitting WRITE_DAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRP_MJ_CREATE callback additionally did not strip WRITE_DAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM. The absence of an IRP_MJ_SET_SECURITY callback in the driver's operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack. ## CVSS-Vektor ``` CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Lokal | good | | AC KomplexitĂ€t | Gering | bad | | PR Privilegien | Gering | warn | | UI Interaktion | Keine | bad | | S Scope | VerĂ€ndert | bad | | C Vertraulichkeit | Hoch | bad | | I IntegritĂ€t | Hoch | bad | | A VerfĂŒgbarkeit | Hoch | bad | ## Referenzen - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-82964) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_