PT-2026-138080
CVE-2026-12067
·
تاريخ النشر
2026-11-06
·
تاريخ التحديث
2026-11-06
الوصف من
الدرجة
N/A
غير متوفرلا تتوفر حاليًا تقييمات أو مقاييس للخطورة. سنحدّث المعلومات المقابلة في الصفحة فور توفرها.
Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.
The vulnerability spans multiple handler pathways in the RPC-based native message protocol:
- Log NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries.
- OpenInSz NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception.
- OpenInSz NmSvc.profile handler: converts the profile field to an integer without validation.
In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾