CVE-2026-80303: Avast WFP stream parser integer underflow causes system crash
Gen Digital · Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate
Vendor fix available · Affected: Gen Digital Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 2% of scored CVEs
DescriptionCVE.org
An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causing a system crash. The WFP callout driver processes network stream data and computes length values for packet fragment reassembly. The length calculation does not properly validate input stream sizes against expected boundaries. When processing specially crafted input, the length computation underflows, resulting in allocation or buffer access with an extremely large wrapped-around size value. The underflow can be triggered remotely via network traffic destined for the filtered port, or locally via crafted data provided to the filtering interface. The resulting memory allocation failure or out-of-bounds access causes a kernel panic and system crash.
Affected products3
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Gen Digital · Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimatebefore 26.7
- Gen Digital · AVG Antivirus Free, AVG Internet Security, AVG Ultimatebefore 26.7
- Gen Digital · Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advancedbefore 26.7
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Gen Digital
- Published
- November 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-80303 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.