Avira Internet Security includes a TOCTOU flaw within its Optimizer module. The privileged cleanup service, running as SYSTEM, first scans the file system and records directories slated for removal, then deletes them in a second phase without re‑validating the actual path. A local user can replace a scanned directory with a junction or reparse point before the delete step, causing the privileged process to erase an unintended target. The result can be deletion of protected files or directories, which may grant the attacker elevated privileges, cause data loss, or destabilize the system. This defect corresponds to CWE‑367.

Gen Digital Inc.’s Avira Internet Security Suite for Windows versions older than 1.1.114.3113 is affected. The vulnerability exists in the Optimizer component and can be triggered on any Windows installation running the vulnerable product.

The severity rating of the issue is 7.8 on the standard scale, and the estimated public exploitation probability is below one percent. It is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker only needs local, non‑privileged access to create a junction or reparse point in a directory that the optimizer will later delete. When the privileged cleanup runs, the attacker can initiate unintended deletion of critical system files, potentially raising privileges or causing denial of service. Despite the low exploitation probability, the high impact of accidental deletion mandates an urgent response.