A security flaw in AVG Internet Security's Data Shredder tool could let an attacker with limited access to a Windows computer take full control of the machine. The vulnerability, tracked as CVE-2026-6064, was publicly disclosed on 28 October 2026 in an advisory from the TrendAI Zero Day Initiative (ZDI-26-832).

How the attack works

The problem sits in the software's avgToolsSvc service, which runs with SYSTEM privileges — the highest level on Windows. The service did not properly check symbolic links before deleting folders, so an attacker who could already run low-privileged code on the machine could plant a link that redirected the service's privileged deletion operation onto files it should never have touched.

Who should update

In plain terms, the attacker lays a trap in the file system and lets the security tool itself spring it. Because the service runs as SYSTEM, the resulting code execution inherits those maximum privileges. The flaw is rated 7.3 HIGH on the CVSS scale and classed as improper link resolution before file access (CWE-59). Exploitation needs local access and low privileges, plus some user interaction, though the exact interaction is unspecified.

AVG Internet Security versions before 26.5.10933 on Windows are affected, and users should move to 26.5.10933 or later. The CVE record also lists Norton Antivirus and Avast Antivirus as affected through the same Data Shredder component, but no separate patch identifier for those brands is given in the advisory, so Norton and Avast users should check their vendor's update channel. The vendor was first told about the flaw on 9 April 2026, with coordinated disclosure following on 28 October. The sources do not say whether the fix arrives by automatic update.

Sources: DeafNews (citing TrendAI Zero Day Initiative advisory ZDI-26-832 and the CVE record for CVE-2026-6064).