CVE-2021-45338

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessarily powerful internal methods of the main antivirus service which could lead to the (1) arbitrary file delete, (2) write and (3) reset security.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST1.1Exploit, Third Party Advisory
https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST1.2Exploit, Third Party Advisory
https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST1.3Exploit, Third Party Advisory
https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast-0Vendor Advisory
https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST1.1Exploit, Third Party Advisory
https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST1.2Exploit, Third Party Advisory
https://github.com/the-deniss/Vulnerability-Disclosures/tree/main/CVE-2021-AVST1.3Exploit, Third Party Advisory
https://www.avast.com/hacker-hall-of-fame/en/researcher-david-eade-reports-antitrack-bug-to-avast-0Vendor Advisory

Timeline

Published: Dec 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-453397.8Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted p CVE-2021-453406.5In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb_image.h component of libsixel allows attackers to cause a CVE-2021-453418.8A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Co CVE-2021-453427.8A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Co CVE-2021-453435.5In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted CVE-2021-453457.5Buffer Overflow vulnerability found in En3rgy WebcamServer v.0.5.2 allows a remote attacker to cause a denial of service via the WebcamServe CVE-2021-453464.3A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Dat CVE-2021-453477.5An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name i CVE-2021-453487.5An Arbitrary File Deletion vulnerability exists in SourceCodester Attendance Management System v1.0 via the csv parameter in admin/pageUploa CVE-2021-453576.1Cross Site Scripting (XSS) vulnerability exists in Piwigo 12.x via the pwg_activity function in include/functions.inc.php.CVE-2021-453649.8A Code Execution vulnerability exists in Statamic Version through 3.2.26 via SettingsController.php. NOTE: the vendor indicates that there w CVE-2021-453798.8Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user with