The absence of exception handling around JSON type conversions in the native message dispatcher (ashServ.dll) allows a local, unprivileged attacker to craft JSON messages that trigger JsonCpp errors. These errors propagate up the dispatcher and cause the AvastSvc service to crash, resulting in a denial of service for all users of the affected antivirus product on the host. The weakness stems from missing type validation and uncaught exceptions, a classic scenario of unchecked exception handling (CWE-248 and CWE-391).

Vulnerable products include Gen Digital's AVG Antivirus Free, AVG Internet Security, AVG Ultimate, Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security, Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, and Norton 360 Advanced. All versions prior to 26.7 are affected; the fix is available in version 26.7 and later for each product family.

EPSS data is unavailable and the vulnerability is not listed in CISA KEV, but the CVSS rating would be high due to the local user privilege, the ability to repeatedly crash the service, and the significant impact on antivirus functionality. Exploitation requires only local user access and the ability to send crafted JSON messages via the RPC interface that is part of normal service operation. Because it is a denial-of-service flaw rather than a remote code execution vector, the barrier to exploitation is relatively low for a local attacker.