Avast Antivirus Zero-Day PoC Lets Attackers Dump SAM Database and Gain SYSTEM Shell

A public proof-of-concept (PoC) repository has revealed a local privilege escalation zero-day vulnerability in GenDigital’s Avast Antivirus.

This vulnerability allows an attacker to dump the Windows Security Account Manager (SAM) database and launch a shell running as NT AUTHORITY\SYSTEM.

The researcher behind the repository, known as MSNightmare, claims that the issue affects fully patched installations of Avast Antivirus on Windows 11 25H2 systems.

Avast Antivirus Zero-Day PoC

The PoC, hosted in a GitHub repository named PrettyPrague, attributes the issue to a flaw in the Avast Sandbox component.

According to the repository’s README, this vulnerability enables an attacker with local execution access to exploit the sandbox’s elevated privileges to retrieve the SAM database and obtain a full SYSTEM-level command shell.

Running as SYSTEM grants the highest local privileges on Windows. If validated, this vulnerability would allow an attacker to bypass the privilege boundaries that the endpoint security product is supposed to enforce.

This turns antivirus software, typically designed to protect the operating system, into a potential vector for a complete local takeover.

The Security Account Manager database is critical because it stores sensitive local account credentials, including password hashes. Gaining access to the SAM hive can facilitate offline password-cracking attempts, credential theft, and lateral movement within an organization using compromised local administrator credentials.

MSNightmare’s README indicates that the PoC is compatible with “any version of Avast Antivirus” and has been successfully tested with patched versions of Avast and Windows 11 25H2.

The repository was last updated on August 30 and includes C and C++ source code, Visual Studio project files, headers, a compiled x64 release directory, and an offreg.lib library.

As of now, the GitHub project does not list a formal release, CVE identifier, vendor advisory, affected version information, or patch details. The researcher also mentioned that the vulnerability might affect other GenDigital security products, such as AVG and Norton.

However, these claims remain unverified until GenDigital confirms which software is affected and under what conditions.

The availability of source code and a compiled release directory amplifies the urgency for defenders. While public PoCs can accelerate independent validation by researchers, they also lower the barrier for threat actors who already have local access to a Windows endpoint.

The reported vulnerability appears to be a local elevation-of-privilege issue, rather than a flaw for initial access. An attacker would need the ability to execute code on a machine, which could occur through phishing, malicious downloads, stolen remote-access credentials, exploitation of other bugs, or misuse of legitimate software.

Security teams should monitor for suspicious child processes initiated by Avast-related services or sandbox components, unexpected command interpreters running under SYSTEM, access to the SAM registry hive, and unusual creation of registry hive dump files.

Endpoint telemetry should be reviewed for unexpected access to HKLM\SAM, HKLM\SYSTEM, or specific paths associated with registry backup and credential-dumping activities.

Organizations using Avast should inventory their deployed versions, restrict local administrator access, prevent unauthorized users from executing binaries on endpoints, and apply any vendor-provided mitigation or updates as soon as they become available.

Until an official response is issued, defenders should avoid assuming that related GenDigital products are vulnerable solely on the basis of preliminary claims in the repository.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.