CVE-2024-13962: Link Following Local Privilege Escalation Vulnerability in Avast Cleanup Premium Version 24.2.16593.17810

Published May 9, 2025

Updated

Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Gen Digital Inc. Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack.

Affected Software

1 affected component

Gen Digital Avast Cleanup Premium

Remediation

Information

Upgrade to Avast Cleanup Premium 24.3.17165.19178 or newer

Event History

May 9, 2025

CVE Published

via MITRE·03:20 PM

Data Sourced

via MITRE·03:20 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-13962?

CVE-2024-13962 has a high severity rating due to its potential for local privilege escalation and arbitrary code execution.

How do I fix CVE-2024-13962?

Fixing CVE-2024-13962 involves applying the latest patches provided by Gen Digital for Avast Cleanup Premium.

Who is affected by CVE-2024-13962?

CVE-2024-13962 affects users of Avast Cleanup Premium on Windows 10 Pro x64.

What types of attacks can exploit CVE-2024-13962?

Local attackers can exploit CVE-2024-13962 to escalate privileges and execute arbitrary code as the SYSTEM user.

Is it important to address CVE-2024-13962 immediately?

Yes, addressing CVE-2024-13962 is crucial due to the significant risk of unauthorized access and system compromise.