CVE-2026-27750 is a TOCTOU race condition in Avira Internet Security's Optimizer component. The vulnerability arises because a privileged service running as SYSTEM identifies directories for cleanup during a scan phase and deletes them in a separate cleanup phase without revalidating the target path. A local attacker can replace a previously scanned directory with a junction or reparse point before deletion, causing the privileged process to delete unintended system locations. This can lead to deletion of protected files or directories and may result in local privilege escalation, denial of service, or compromise of system integrity.

Successful exploitation allows a local attacker to cause a privileged SYSTEM process to delete unintended system files or directories by exploiting a race condition. This can lead to local privilege escalation, denial of service, or compromise of system integrity depending on which system locations are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running untrusted code with local access on affected systems and monitor for updates from Gen Digital Inc. regarding patches or mitigations.