CVE-2026-12067

Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages. The vulnerability spans multiple handler pathways in the RPC-based native message protocol: * Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries.  * OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception. * OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation. In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.

• https://support.avast.com/en-us/article/Update-Antivirus
• https://support.avg.com/SupportArticleView?l=en&urlname=Update-AVG-Antivirus
• https://support.norton.com/sp/en/us/home/current/solutions/v20240108175512167
• https://www.gendigital.com/us/en/contact-us/security-advisories/

• MEDIUMCVE-2026-100347PoC
• MEDIUMCVE-2026-100675PoC
• MEDIUMCVE-2026-100722PoC
• MEDIUMCVE-2026-101035PoC
• MEDIUMCVE-2026-101101PoC
• MEDIUMCVE-2026-101175
• MEDIUMCVE-2026-101918PoC
• HIGHCVE-2026-102281PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.