Vulnerability Report

CVE-2017-8307

Title: Avast Antivirus Denial of Service (DoS)

DoS

Proof Of Concept

No public PoC currently indexed for CVE-2017-8307.

CWE Category NVD-CWE-noinfo

Published Date Apr 27, 2017

Modified Date May 13, 2026

Exploit Status Not Found

Score 9.8 CVSS v3.0

Exploit Probability (EPSS)

0.99%

Vulnerability Summary

CVE-2017-8307: In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled. It is also exploitable in conjunction with CVE-2017-8308 when Avast Self-Defense is enabled. The vulnerability allows for Denial of Service attacks and hiding traces of a possible attack.

Impacted Vendors

trustix 1

avast 1

Reference Links

http://www.securityfocus.com/bid/98086 https://www.trustwave.com/Resources/Security-Advisories/Advisories/Multiple-Vulnerabilities-in-Avast-Antivirus/?fid=9201 http://www.securityfocus.com/bid/98086 https://www.trustwave.com/Resources/Security-Advisories/Advisories/Multiple-Vulnerabilities-in-Avast-Antivirus/?fid=9201

CVSS v3.0

Source Entity [email protected]

Severity CRITICAL

9.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity HIGH

7.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns