A critical privilege escalation vulnerability in the Avast sandbox driver allows low-privileged local users to gain SYSTEM-level access to the host machine.

The vulnerability exists in the aswSnx.sys minifilter driver, which fails to correctly apply security descriptors when virtualizing files. A local, low-privileged user can exploit this to rewrite security descriptors, access sensitive files such as the SAM database, and execute code with SYSTEM privileges.

Successful exploitation allows an attacker who already has minimal access to the system to achieve full administrative control. This represents a complete compromise of the host machine, potentially leading to total data exfiltration, installation of persistent malware, and complete loss of system integrity. With a CVSS score of 8.8, this vulnerability is classified as High severity due to the ease of local exploitation and the catastrophic nature of the resulting privilege escalation.

Immediate Action: Ensure all Gen Digital antivirus products are updated to version 26.8 or later and verify that a full system restart has been performed to load the patched kernel-mode driver.

Proactive Monitoring: Monitor system logs for suspicious process creation involving access to sensitive system directories or attempts to interact with the SAM database.

Compensating Controls: Limit local user access to the absolute minimum required for their roles and apply strict host-based access control policies to prevent unauthorized execution of code within the user environment.

Public Exploit Available: Yes, a published proof-of-concept exists in the MSNightmare PrettyPrague GitHub repository.

Given the availability of a functional proof-of-concept and the severity of the impact, immediate remediation is required. Administrators must ensure that the automatic micro-update is applied and, crucially, that the mandatory system reboot is performed, as the system remains vulnerable until the updated driver is successfully loaded into kernel memory.