Avira Internet Security’s System Speedup component deserializes data from a file in the ProgramData directory using .NET’s BinaryFormatter without prior validation or safeguards. The deserialization logic runs with SYSTEM privileges in the Avira.SystemSpeedup.RealTimeOptimizer.exe process, allowing a crafted payload to execute arbitrary code at the highest privilege level. The flaw is classified as insecure deserialization (CWE‑502).

Any Windows system that has Avira Internet Security installed and retains the System Speedup component before the patched version 1.1.114.3113. The vulnerability arises from the default configuration that permits local users to create or modify the target file in the ProgramData folder.

The flaw carries a CVSS score of 7.8, indicating high severity, yet the EPSS score is below 1 %, suggesting that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Attackers must be able to write to the designated file, implying a local user or local privilege escalation context. If this condition is satisfied, a crafted serialized payload could trigger the SYSTEM‑privileged process to execute arbitrary code. The specific payload details are not provided in the CVE description, so the exact exploitation method is inferred from the insecure deserialization weakness.