Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-12067 EUVD-2026-118327GHSA-fpp4-5g35-6qq3

AvastSvc denial of service via unhandled JsonCpp exceptions in native message handlers

Published Nov 6, 2026 · Updated Nov 10, 2026 · Assigned by GEN

Description

Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.

The vulnerability spans multiple handler pathways in the RPC-based native message protocol:

* Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries. 
* OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception.
* OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation.

In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.

Affected products

VendorProductAffectedFixed
Gen Digital Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security < 26.7 26.7
Gen Digital AVG Antivirus Free, AVG Internet Security, AVG Ultimate < 26.7 26.7
Gen Digital Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced < 26.7 26.7

References