The vulnerability is an unquoted service path flaw (CWE-428) in AVAST Antivirus 25.11’s SecureLine service. It allows a local user to place a malicious executable in the service directory that will run with SYSTEM privileges when the service starts, resulting in local privilege escalation and compromising overall system security.

The flaw affects Avast’s AVAST Antivirus version 25.11. Systems running this version are vulnerable; no other products or version variants are listed as affected.

The CVSS score of 8.5 indicates high severity. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the public exploitation likelihood is unknown, but the local attack vector and high‑severity impact suggest a significant risk to unprotected systems. Attackers must be able to write to the service directory and restart the service to trigger the payload. The lack of remote exposure limits remote exploitation but still requires local access.