Vulnerability Details CVE-2026-27749
Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.exe process, which runs with SYSTEM privileges, deserializes data from a file located in C:\\ProgramData using .NET BinaryFormatter without implementing input validation or deserialization safeguards. Because the file can be created or modified by a local user in default configurations, an attacker can supply a crafted serialized payload that is deserialized by the privileged process, resulting in arbitrary code execution as SYSTEM.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 13.3%
CVSS Severity
CVSS v3 Score 7.8
References
- https://blog.quarkslab.com/avira-deserialize-delete-and-escalate-the-proper-way-to-use-an-av.html
- https://support.avira.com/hc/en-us/articles/360010656158-Current-Avira-versions
- https://www.avira.com/en/internet-security
- https://www.vulncheck.com/advisories/avira-internet-security-system-speedup-insecure-deserialization
Products affected by CVE-2026-27749
-
cpe:2.3:a:avira:internet_security:*