Local Privilege Escalation in AVG Internet Security avgToolsSvc (CVE‑2026‑6064) Enables SYSTEM‑Level Code Execution
What It Is — AVG Internet Security’s avgToolsSvc service contains a flaw that lets a low‑privileged attacker create a symbolic link, causing the service to delete an arbitrary folder and subsequently execute code as SYSTEM. The vulnerability (CVE‑2026‑6064) scores 7.3 (CVSS AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). Exploitation requires prior local code execution, but once achieved it grants full system control. AVG released a fix in version 26.5; the advisory was coordinated on 28 Oct 2026.
Affected Products — AVG Internet Security (all versions prior to 26.5).
Why It Matters for Trust & Control Assurance — The issue highlights the importance of privileged‑access controls and evidence‑driven verification that services run with the least privilege. Capability focus: ACCESS_CONTROLS.
Recommended Actions —
- Upgrade to AVG Internet Security 26.5 or later.
- Verify that avgToolsSvc is configured to run with the minimum required privileges.
- Deploy endpoint monitoring for unexpected symbolic‑link creation or unauthorized folder deletions.
- Record the patch status and service configuration as audit evidence.
Source: Zero Day Initiative advisory