CVE-2023-42125 - CVE House
Back to Database
Status published High CVE-2023-42125

Avast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability

Vulnerability Description

Avast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Premium Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the implementation of the sandbox feature. By creating a symbolic link, an attacker can abuse the service to create arbitrary namespace objects. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. . Was ZDI-CAN-20383.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-42125

Credits & Attribution

No credits recorded in the NVD database.

References

More from Avast

View All →
CVE-2025-7007
Null pointer dereference in Avast Antivirus on macOS (16.0.0) or Linux (3.0.3)
High 7.5
CVE-2025-71326
AVAST Antivirus 25.11 Unquoted Service Path Privilege Escalation
High 8.5
CVE-2025-4134
Lack of file validation in Avast Business Antivirus for Linux allows writing untrusted update files
High 7.3
CVE-2025-3500
Integer Overflow in Avast Antiviurs 25.1.981.6 on Windows may result in privilege escalation
Critical 9
CVE-2025-13032
Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 ...
Critical 9.9

Affected Vendor

Affected Software

Premium Security
Vulnerable Versions:
Avast Premium Security 22.12.6044 (build 22.12.7758.769)

Timeline

Official Publish: May 3rd, 2024
Last Modified: September 20th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-706

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.