The vulnerability is an improper sandbox isolation flaw that allows a local, low‑privileged process within Avast's sandbox to create and use COM objects that bind to the Windows Task Scheduler service. Because the sandbox policy does not block this COM pathway, the attacker can invoke Task Scheduler methods to create, schedule, or modify tasks that execute code in the host's security context, effectively escaping containment and gaining elevated privileges.

The flaw affects Gen Digital products such as AVG Antivirus Free, AVG Internet Security, AVG Ultimate, Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, and Norton products including Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, and Norton 360 Advanced. All versions released before 26.7 are vulnerable; the fix is available in version 26.7 or later.

The vulnerability is exploitable only by an attacker who can run code within the Avast sandbox, typically requiring local user privilege or initial compromise. Once inside, the attacker can schedule arbitrary tasks that run with host privileges. Because this is a local attack vector and the transformation to host‑level privilege is direct, the risk is significant; however, no current exploitation reports or CISA KEV listing are known. The EPSS score is not available, suggesting no high public exploitation but the severity should be treated as high.