CVE-2026-5424 is a local privilege escalation vulnerability in Avast Premium Security's Gen Self Protection driver. The vulnerability arises from an exposed dangerous function within the driver, which can be leveraged by an attacker who already has the ability to execute low-privileged code on the target system. Successful exploitation allows arbitrary code execution with SYSTEM privileges, significantly elevating the attacker's control over the affected system. The vulnerability carries a CVSS v3 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It was reported to Avast on April 1, 2026, and a coordinated public advisory was released on April 15, 2026. Avast addressed the issue in version 26.3 of Premium Security.

If exploited, this vulnerability allows a local attacker with low-level code execution rights to escalate privileges to SYSTEM level, enabling full control over the affected system. This can lead to compromise of confidentiality, integrity, and availability of the system. However, exploitation requires prior local access and code execution capabilities. There are no known exploits in the wild as of the advisory date.

The vulnerability has been fixed in Avast Premium Security version 26.3. Users and administrators should update affected installations to version 26.3 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.