CVE-2024-13944: Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate (Also affects Avast CleanUp and AVG TuneUp)
First published: Fri May 09 2025(Updated: )
Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via the creation of a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.
Credit: security@nortonlifelock.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Norton Utilities Ultimate | ||
| Avast Cleanup Premium | ||
| AVG TuneUp |
Remedy
Upgrade to the below versions, or newer, released 19/Dec/2024 * Norton Utilities 24.3 SU1 - 24.3.17165.6812 * Avast Cleanup 24.3-SU1 - 24.3.17165.19178 * AVG TuneUp 24.3-SU1 - 24.3.17165.10564
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-13944?
CVE-2024-13944 is rated as a high-severity local privilege escalation vulnerability.
How do I fix CVE-2024-13944?
To fix CVE-2024-13944, update Norton Utilities Ultimate to the latest version available.
Who is affected by CVE-2024-13944?
CVE-2024-13944 affects users of Norton Utilities Ultimate on Windows 10 Pro x64.
What type of vulnerability is CVE-2024-13944?
CVE-2024-13944 is a local privilege escalation vulnerability that allows attackers to execute arbitrary code.
Can CVE-2024-13944 be exploited remotely?
No, CVE-2024-13944 requires local access to the vulnerable system to escalate privileges.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/remedy
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/norton
- canonical/norton utilities ultimate
- vendor/avast
- canonical/avast cleanup premium
- vendor/avg
- canonical/avg tuneup