Avira vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-13759 Local Privilege Escalation in Avira.Spotlight.Service.exe in Avira Prime 1.1.96.2 on Windows 10 x64  allows local attackers to gain system-level privileges via High 7.8 · May 9, 2025
• CVE-2023-51636 Avira Prime Link Following Local Privilege Escalation Vulnerability.High 7.8 · May 22, 2024
• CVE-2023-36673 An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS.High 7.3 · Aug 9, 2023
• CVE-2023-1900 A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an overflow.High 7.8 · Apr 19, 2023
• CVE-2020-12463 An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links.High 7.8 · May 5, 2020
• CVE-2020-12254 Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink.High 7.8 · Apr 26, 2020
• CVE-2020-8961 An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825.Critical 9.8 · Apr 9, 2020
• CVE-2019-18568 Avira Free Antivirus 15.0.1907.1514 is prone to a local privilege escalation through the execution of kernel code from a restricted user.High 8.8 · Dec 31, 2019
• CVE-2019-11396 An issue was discovered in Avira Free Security Suite 10.High 7.8 · Aug 29, 2019
• CVE-2016-10402 Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large relative virtual addrHigh 7.8 · Jul 27, 2017
• CVE-2015-7732 The Avira Mobile Security app before 1.5.11 for iOS sends sensitive login information in cleartext.High 7.5 · Jun 15, 2017
• CVE-2015-7303 Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header.High 10 · Sep 21, 2015
• CVE-2009-2761 Unquoted Windows search path vulnerability in the scheduler (sched.exe) in Avira AntiVir, AntiVir Premium, Premium Security Suite, and AntiVir Professional mighHigh 7.2 · Aug 13, 2009
• CVE-2008-6962 Avira AntiVir Premium, Premium Security Suite, AntiVir Professional, and AntiVir Personal - FREE allows local users to execute arbitrary code via a crafted IOCTHigh 7.2 · Aug 13, 2009
• CVE-2007-2972 The file parsing engine in Avira Antivir Antivirus before 7.04.00.24 allows remote attackers to cause a denial of service (application crash) via a crafted UPX High 7.8 · May 31, 2007
• CVE-2007-2973 Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed TAR archive.High 7.8 · May 31, 2007
• CVE-2007-2974 Buffer overflow in the file parsing engine in Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to execute arbitrary code via a crafted LZH archHigh 10 · May 31, 2007
• CVE-2007-1671 avpack32.dll before 7.3.0.6 in Avira AntiVir allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure thHigh 7.8 · May 8, 2007
• CVE-2006-1274 Classic Planer in AntiVir PersonalEdition Classic 7 does not drop privileges before executing external programs, which allows local users to gain privileges viaHigh 7.2 · Mar 19, 2006
• CVE-2005-2957 Stack-based buffer overflow in AVIRA Desktop for Windows 1.00.00.68 with AVPACK32.DLL 6.31.0.3, when archive scanning is enabled, allows remote attackers to exeHigh 7.5 · Sep 16, 2005