CVE-2026-12067
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
63/100
Published: 2026-11-06
Modified: 2026-11-12
First seen: 2026-11-06
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.
The vulnerability spans multiple handler pathways in the RPC-based native message protocol:
* Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries.
* OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception.
* OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation.
In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.
Weakness Classification (2)
Affected Software (6)
| Vendor | Product | Version |
|---|
| Gen Digital |
AVG Antivirus Free, AVG Internet Security, AVG Ultimate |
0
< 26.7
|
| Gen Digital |
AVG Antivirus Free, AVG Internet Security, AVG Ultimate |
0
< 26.7
|
| Gen Digital |
Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security |
0
< 26.7
|
| Gen Digital |
Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security |
0
< 26.7
|
| Gen Digital |
Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced |
0
< 26.7
|
| Gen Digital |
Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced |
0
< 26.7
|
References & Advisories (4)