Gen Digital
CVE-2026-12067: Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending s
CVE-2026-12067 Nov 6, 2026 Source: Vendor
Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.
The vulnerability spans multiple handler pathways in the RPC-based native message protocol:
* Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries.
* OpenInSz_NmSvc handler: converts URL and origin fields to strings without type check
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-12067
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
Showing 1–1 of 1
CVE-2026-12067
BR2026-0000-043017
unclaimed
Credited as Teng Zheng Wang by VulnGuard Labs