CVE-2025-71326

HighCVSS 7.8/10Last modified Oct 6, 2026

Description

AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with elevated SYSTEM privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables that execute with high-level system permissions.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jun 19, 2026
Last modified: Oct 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-713279.1Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated att CVE-2025-713288.8Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through CVE-2025-713297.5image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop CVE-2025-71335.4A vulnerability classified as problematic has been found in CodeAstro Online Movie Ticket Booking System 1.0. This affects an unknown part. CVE-2025-713307.5image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop CVE-2025-713316.1Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom CVE-2025-713328.8Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id v CVE-2025-713339.8Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType i CVE-2025-713349.8Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that th CVE-2025-713358.1Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes th CVE-2025-713369.8Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom CVE-2025-713378.3Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can cha