CVE-2024-5102 is a high severity (CVSS 7.0) local privilege escalation in Avast Antivirus for Windows before version 24.2. The Repair feature deletes a file as SYSTEM and can be steered through links to other files. Update Avast to a current release.
What's affected
The record lists Avast Antivirus versions below 24.2 on Windows. It was published on 10 June 2024 and cites the Norton and Gen Digital security advisories page, which redirected to a Gen Digital address when we tried to read it.
The local attack vector and the high attack complexity fit the 7.0 score. The attacker must already run code as a low privileged user on the machine. The fixed version is taken from the record's wording, 24.2 and above. Confirm against the vendor advisory.
How to check if you're exposed
On a single machine, open Avast, go to Menu, then Settings, then General and look at the product version, or check Programs and Features in Windows. For a fleet, query installed software through your endpoint tool:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object DisplayName -like '*Avast*' |
Select-Object DisplayName, DisplayVersion
Avast ships its own versioning scheme, so compare the build against the vendor advisory rather than assuming a number that looks higher is safe.
What to do now
- Update Avast Antivirus through its built in updater to a build at or above 24.2.
- For managed estates, push the update with your software distribution tool and verify the version afterwards.
- Limit local logon rights on shared or kiosk machines where an unprivileged user could run code.
- Watch for repair operations triggered by non administrators in your endpoint logs.
- Read the vendor advisory page for the exact fixed build number for your edition.
Why it matters
The weakness list pairs CWE-59 (link following) with CWE-1284 (improper validation of a specified quantity). The advisory explains the pattern: a service running as SYSTEM deletes a file in a path the user controls, so a link planted in that path can point the deletion at a file the user could not touch.
That class of bug turns up repeatedly in security tools, which run with high privilege and act on user writable folders. Security software is a worthwhile target precisely because of that privilege. The record does not set the KEV flag, and it describes a race condition, which is why complexity is rated high.
Quick check
Can this be exploited remotely?
Not by itself. The attacker needs local code execution as a low privileged user first.
Does the record name a fix?
It names the boundary, versions before 24.2. Check the vendor advisory for the current build.
Sources
Last reviewed: 19 October 2026.
