CVE-2026-12067
Full vulnerability record from the local CVENow database.
Description
Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages. The vulnerability spans multiple handler pathways in the RPC-based native message protocol: * Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries. * OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception. * OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation. In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.
View original CVE JSON
{
"id": "CVE-2026-12067",
"sourceIdentifier": "[email protected]",
"published": "2026-11-06T16:17:55.640",
"lastModified": "2026-11-06T16:17:55.640",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.\n\n\n\nThe vulnerability spans multiple handler pathways in the RPC-based native message protocol:\n\n * Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries. \n * OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception.\n * OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation.\n\n\nIn all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Gen Digital",
"product": "Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security",
"defaultStatus": "affected",
"platforms": [
"Windows"
],
"versions": [
{
"version": "0",
"lessThan": "26.7",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Gen Digital",
"product": "AVG Antivirus Free, AVG Internet Security, AVG Ultimate",
"defaultStatus": "affected",
"platforms": [
"Windows"
],
"versions": [
{
"version": "0",
"lessThan": "26.7",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Gen Digital",
"product": "Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced",
"defaultStatus": "affected",
"platforms": [
"Windows"
],
"versions": [
{
"version": "0",
"lessThan": "26.7",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-248"
},
{
"lang": "en",
"value": "CWE-391"
}
]
}
],
"references": [
{
"url": "https://support.avast.com/en-us/article/Update-Antivirus",
"source": "[email protected]"
},
{
"url": "https://support.avg.com/SupportArticleView?l=en&urlname=Update-AVG-Antivirus",
"source": "[email protected]"
},
{
"url": "https://support.norton.com/sp/en/us/home/current/solutions/v20240108175512167",
"source": "[email protected]"
},
{
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/",
"source": "[email protected]"
}
]
}