CVE-2026-107707

Intego Windows Optimizer arbitrary directory deletion

Intego 3.0.0.1 deleted duplicate-file targets as SYSTEM without revalidating their type, enabling a junction and symlink chain to remove Config.msi and escalate to SYSTEM.

Vendor

Intego

Product

Intego Antivirus for Windows

Component

Windows Optimizer / IavService.exe

Disclosure

Apr 07, 2026

Bug class

TOCTOU, symlink following, improper type validation

Severity

High (CVSS 3.1: 7.8)