CVE-2015-8620

HIGH 7.8CVE-2015-8620 · Published 13/04/2016 · updated 17/06/2026

In short

CVE-2015-8620 is a HIGH (CVSS 7.8) vulnerability affecting avast free antivirus (avast), avast internet security (avast), avast premier (avast).
Chance of exploitation in the next 30 days (EPSS): 0.50%, higher than 43.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
avast free antivirus avast	`≤ 11.1.2245`	No fix yet
avast internet security avast	`≤ 11.1.2245`	No fix yet
avast premier avast	`≤ 11.1.2245`	No fix yet
avast pro antivirus avast	`≤ 11.1.2245`	No fix yet

Description

Heap-based buffer overflow in the Avast virtualization driver (aswSnx.sys) in Avast Internet Security, Pro Antivirus, Premier, and Free Antivirus before 11.1.2253 allows local users to gain privileges via a Unicode file path in an IOCTL request.

References

packetstormsecurity.com/files/135859/Avast-11.1.2245-Heap-Overflow.html · Exploit
seclists.org/fulldisclosure/2016/Feb/94 · Exploit
securitytracker.com/id/1035093 · Third Party Advisory
nettitude.co.uk/exploiting-a-kernel-paged-pool-buffer-overflow-in-avast-virtualization-driver · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free