Researcher Chaotic Eclipse has claimed to have discovered a zero-day privilege-escalation vulnerability affecting Avast Antivirus and released a public proof-of-concept repository named PrettyPrague.
The researcher behind the project, using the GitHub handle MSNightmare, says the issue can be exploited on fully patched Avast Antivirus installations running fully updated Windows 11 25H2 systems.
The alleged flaw is described as an elevation-of-privilege vulnerability in Avast Sandbox, a component designed to isolate suspicious files and reduce the damage from potentially malicious programs.
According to the GitHub advisory from Chaotic Eclipse, the proof of concept abuses the sandbox mechanism to access the Windows Security Account Manager, or SAM, database and open a command shell with NT AUTHORITYSYSTEM privileges.
SYSTEM is the most powerful local security context on Windows. An attacker who already has code execution on a machine could potentially use a working local privilege-escalation flaw to bypass restrictions placed on a standard user account.
From there, they may attempt to access protected credentials, turn off security controls, install persistent tools, or alter critical operating system settings.
Avast Antivirus 0-Day Vulnerability PoC Released
The public repository claims that the proof of concept is compatible with any version of Avast Antivirus. However, that assertion has not been independently verified through a vendor advisory or a public CVE record.
The project author also speculated that other GenDigital products, including AVG and Norton, may be affected, but provided no confirmed technical evidence for those products. Organizations should treat the broader product-impact claim as unverified until GenDigital publishes an official assessment.
The source repository contains C and C++ project files, Windows-related headers, a compiled x64 release directory, and a file named offreg.lib. Its stated objective is to dump the SAM database and start a SYSTEM shell by exploiting the alleged Avast Sandbox weakness.
The repository was last updated on August 30, 2026, and is publicly accessible, increasing the risk that other researchers, defenders, or malicious actors may test the claim.
A public proof of concept can accelerate defensive validation. However, it can also reduce the time available for affected organizations to react.
Security teams using Avast should monitor official GenDigital security advisories, confirm the installed product version and configuration, and review endpoint telemetry for unusual child processes launched by Avast-related services or sandbox components.
Defenders should also investigate unexpected access to the SAM database, unusual registry activity involving security-sensitive hives, and new processes running as SYSTEM without a normal administrative explanation.
Endpoint detection rules should focus on suspicious execution chains where low-privileged user processes interact with antivirus sandbox services before privileged command interpreters or credential-access tools appear.
At the time of writing, the GitHub project does not identify a CVE number, disclose a coordinated vendor response, or provide evidence that a patch is available.
Until those details are confirmed, the report should be viewed as an unverified but potentially serious local privilege-escalation claim involving Avast Antivirus.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post Chaotic Eclipse Claims Avast Antivirus 0-Day Vulnerability – PoC Released appeared first on Cyber Security News.