Cybersecurity researcher Chaotic Eclipse has uncovered a serious zero-day vulnerability in Avast Antivirus, which has been publicly disclosed through a proof-of-concept repository named PrettyPrague. This vulnerability, found in Avast’s Sandbox component, threatens to escalate user privileges on fully updated Windows 11 systems, raising significant security concerns.
Details of the Security Flaw
The researcher, known on GitHub as MSNightmare, claims the vulnerability can be exploited on patched versions of Avast Antivirus. The flaw is an elevation-of-privilege issue within the Avast Sandbox, which is designed to provide a secure environment for isolating suspicious files. By manipulating this sandbox mechanism, attackers could potentially access the Windows Security Account Manager (SAM) database and gain NT AUTHORITYSYSTEM privileges.
The SYSTEM authority grants significant control over a system, allowing attackers to bypass standard user account restrictions. This could enable unauthorized access to protected credentials, the disabling of security features, and the installation of persistent malware or alteration of critical system settings.
Extent and Impact of the Vulnerability
The public repository indicates that the proof of concept is compatible with all versions of Avast Antivirus, although this has not been independently corroborated by a vendor advisory or a public CVE reference. The author speculates that other GenDigital products, such as AVG and Norton, might also be affected, but no technical confirmation has been provided for these claims.
The repository, last updated on August 30, 2026, includes C and C++ project files and outlines exploiting the Avast Sandbox flaw to access the SAM database and initiate a SYSTEM shell. The public availability of this repository increases the risk of exploitation by both researchers and potential attackers.
Recommendations for Organizations
Organizations using Avast Antivirus should remain vigilant and monitor any official security advisories from GenDigital. It’s crucial to verify installed product versions and configurations while reviewing endpoint telemetry for unusual processes related to Avast services or sandbox components.
Security teams should be alert for unexpected SAM database access, unusual registry activities, and new SYSTEM-level processes. Detection rules should focus on suspicious execution chains involving low-privileged user processes interacting with antivirus sandbox services.
Currently, no CVE number or coordinated vendor response has been announced, nor is there evidence of a patch. Until further details are confirmed, this vulnerability should be treated as an unverified but potentially serious threat.
