CVE-2026-82964: Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys
Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM.
When the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERICWRITE and FILEWRITEATTRIBUTES only, omitting WRITEDAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRPMJCREATE callback additionally did not strip WRITEDAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM.
The absence of an IRPMJSETSECURITY callback in the driver's operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Avast sandbox driver (aswSnx.sys)to a version that resolves this vulnerability.Fixed in 26.7.1021.0 - Upgrade
Upgrade
AVG sandbox driver (avgSnx.sys)to a version that resolves this vulnerability.Fixed in 26.7.1021.0 - Upgrade
Upgrade
Norton sandbox driver (nllSnx.sys)to a version that resolves this vulnerability.Fixed in 26.7.1021.0 - Upgrade
Upgrade
Avast sandbox driver (aswSnx.sys)to a version that resolves this vulnerability.Fixed in 26.8.1020.0 - Upgrade
Upgrade
AVG sandbox driver (avgSnx.sys)to a version that resolves this vulnerability.Fixed in 26.8.1020.0 - Upgrade
Upgrade
Norton sandbox driver (nllSnx.sys)to a version that resolves this vulnerability.Fixed in 26.8.1020.0 - Operational
After installing the Gen Digital micro-update for the sandbox driver, restart the affected device so the driver replacement loads. Until the device restarts, the previous sandbox driver stays active and the system remains vulnerable.
- Operational
To confirm remediation after restart, verify the running sandbox driver binary version for Avast/AVG/Norton (aswSnx.sys / avgSnx.sys / nllSnx.sys) is at or above the fixed driver versions (26.7.1021.0 for the 26.7 release line, 26.8.1020.0 for the 26.8 release line), rather than checking the product version number.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Windows systems using the Avast Sandbox minifilter driver, aswSnx.sys, are exposed when a low-privileged attacker can execute code inside the Avast sandbox. The described attack targets virtualized copies of sensitive files created by that sandbox.
What does an attacker need to exploit it?
The attacker needs local code execution with low privileges inside the sandbox. No user interaction is required, and the attacker can then modify permissions on a virtualized sensitive object, read the virtualized SAM database, extract local NTLM hashes, and execute code as SYSTEM.
What should be prioritized for remediation?
Update Avast Antivirus using the vendor's update guidance and consult the vendor security advisory. The issue is in aswSnx.sys, so remediation should ensure the Avast Sandbox minifilter driver is updated.