# Zero-Day Vulnerability Alleged in Avast Antivirus by Researcher

*Published September 4, 2026*
*Source: [https://cybersecuritynews.com/avast-antivirus-0-day-vulnerability-poc-released/](https://cybersecuritynews.com/avast-antivirus-0-day-vulnerability-poc-released/)*

## Executive Summary

Researcher Chaotic Eclipse claims to have discovered a zero-day vulnerability in Avast Antivirus, affecting Windows 11 systems. The alleged flaw allows privilege escalation via the Avast Sandbox, but its validity remains unverified by Avast or through an official CVE record.

## Article

A researcher known as Chaotic Eclipse has claimed to uncover a zero-day vulnerability in Avast Antivirus, potentially impacting systems running Windows 11. The researcher, who operates under the GitHub alias MSNightmare, released a public proof-of-concept named PrettyPrague, which reportedly demonstrates how the vulnerability can be exploited on fully patched Avast installations. The flaw is characterized as an elevation-of-privilege issue within Avast's Sandbox component, designed to contain suspicious files and mitigate the damage from malicious software. According to Chaotic Eclipse's GitHub advisory, the proof of concept uses the sandbox mechanism to access the Windows Security Account Manager database and open a command shell with NT AUTHORITY\SYSTEM privileges, which is the highest local security level in Windows. If an attacker already has code execution on a machine, they could potentially exploit this flaw to bypass user account restrictions, access protected credentials, disable security controls, install persistent tools, or modify critical operating system settings. While the public repository claims compatibility with any version of Avast Antivirus, this has not been independently verified by Avast or through a public CVE record. The project also speculates that other GenDigital products, such as AVG and Norton, may be affected, though no technical evidence has been provided for these claims. The proof of concept includes C and C++ project files, Windows headers, a compiled x64 release directory, and aims to exploit the alleged sandbox weakness to gain SYSTEM-level access. The repository was last updated on August 30, 2026, and is publicly available, posing a risk as it could be tested by other researchers or malicious actors. Security teams using Avast should keep a close watch on official GenDigital security advisories, verify their product version and configuration, and monitor endpoint telemetry for any unusual activity related to Avast services or sandbox components. Any unexpected access to the SAM database or unusual registry activity should be investigated promptly. Endpoint detection rules should be updated to flag suspicious execution chains that involve antivirus sandbox services. As of now, there is no CVE number or coordinated vendor response, and no patch has been confirmed, making this an unverified yet potentially serious threat.