Avast Antivirus Zero-Day PoC Lets Attackers Dump SAM Database and Gain SYSTEM Shell

A public GitHub proof-of-concept claims a local privilege escalation zero-day in GenDigital’s Avast Antivirus (tested on Windows 11 25H2) that abuses the Avast Sandbox to dump the SAM registry hive and obtain an NT AUTHORITY\SYSTEM shell. The repository contains C/C++ source, project files, and compiled x64 artifacts, increasing the risk that adversaries with local code execution could escalate privileges; defenders are advised to monitor for suspicious Avast-related child processes, SYSTEM-level command interpreters, access to HKLM\SAM/HKLM\SYSTEM, inventory deployed Avast versions, restrict local execution, and apply vendor mitigations when available.