Avira Internet Security contains an improper link resolution flaw in its Software Updater component. During an update, a privileged service running as SYSTEM deletes files under C:\ProgramData without verifying whether the target path is a symbolic link or reparse point. If a local attacker creates a malicious link, the service can delete any file the link points to, effectively allowing the attacker to cause arbitrary file deletion with SYSTEM privileges. This vulnerability can lead to local privilege escalation, denial of service, or compromise of system integrity depending on the file targeted and the system configuration. The weakness is described by CWE-59.

All releases of Gen Digital Inc.’s Avira Internet Security Suite and Internet Security for Windows running on Windows before version 1.1.114.3113 are affected. The issue resides in the updater component of these products. Updating to Avira Internet Security for Windows 1.1.114.3113 or later removes the flaw.

The CVSS score of 7.8 classifies the flaw as high. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access, with the attacker creating a malicious link and triggering the Software Updater to run. The local privileged nature of the attack means that, once leveraged, the attacker can delete any file at the SYSTEM level, potentially escalating privileges further or corrupting critical system files.