Vulnerability record · CVE-2020-10867 · published 1 April 2020

CVE-2020-10867: Avast antivirus exposure of resource to wrong sphere vulnerability

Avast · Antivirus

An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to bypass intended access restrictions on tasks from an untrusted process, when Self Defense is enabled.

9.8 CVSS 3.1 Critical EPSS 2.2% · top 18.1% CWE-668 · Exposure of resource to wrong sphere

9.8CVSS 3.1 base score, v2 7.5

2.2%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Antivirus Avast

References

Link	Tags
https://forum.avast.com/index.php?topic=232420.0	Release NotesVendor Advisory
https://forum.avast.com/index.php?topic=232423.0	Release NotesVendor Advisory
https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md	ExploitThird Party Advisory
https://forum.avast.com/index.php?topic=232420.0	Release NotesVendor Advisory
https://forum.avast.com/index.php?topic=232423.0	Release NotesVendor Advisory
https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.md	ExploitThird Party Advisory

Track CVE-2020-10867 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-3500Avast antivirus integer overflow vulnerabilityInteger Overflow or Wraparound vulnerability in Avast Antivirus (25.1.981.6) on Windows allows Privilege Escalation.This issue affects Antivirus: fro…EPSS 0.46%1 Dec 2025 9.8CVE-2017-8307Avast antivirus vulnerabilityIn Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries,…EPSS 1.8%27 Apr 2017 8.8CVE-2021-45335Avast antivirus incorrect default permissions vulnerabilitySandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, an…EPSS 0.38%27 Dec 2021 8.8CVE-2021-45336Avast antivirus vulnerabilityPrivilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated privilege…EPSS 0.46%27 Dec 2021 8.8CVE-2021-45337Avast antivirus vulnerabilityPrivilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain ele…EPSS 0.43%27 Dec 2021 7.8CVE-2025-13032Avast antivirus toctou race condition vulnerabilityDouble fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflow.EPSS 0.25%11 Nov 2025 7.8CVE-2022-4294Avira security improper privilege management vulnerabilityNorton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an at…EPSS 0.19%10 Jan 2023 7.8CVE-2021-45338Avast antivirus vulnerabilityMultiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessaril…EPSS 0.38%27 Dec 2021

Source: NIST National Vulnerability Database (record CVE-2020-10867), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.