Avira Prime Link Following Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in the System Speedup Service of Avira Prime, version 1.1.96.2, running on Windows 10 x64. This vulnerability allows local attackers to escalate privileges and execute arbitrary code with SYSTEM rights by creating a symbolic link and exploiting a time-of-check to time-of-use (TOCTTOU) race condition.

Impact

Exploitation of this vulnerability allows for local privilege escalation, enabling attackers to execute arbitrary code in the context of the SYSTEM user.