Skip to content
K>Kaluche
  • Research
  • CVEs
  • Search
  • About
discoveredarbitrary directory delete as SYSTEMLPE to SYSTEM

No CVE assigned

Intego Windows Optimizer arbitrary directory deletion

Intego 3.0.0.1 deleted duplicate-file targets as SYSTEM without revalidating their type, enabling a junction and symlink chain to remove Config.msi and escalate to SYSTEM. No CVE was assigned.

Vendor
Intego
Product
Intego Antivirus for Windows
Component
Windows Optimizer / IavService.exe
Disclosure
Apr 07, 2026
Bug class
TOCTOU, symlink following, improper type validation
Severity
Not scored
writeup

© 2026 Kaluche · CC BY-NC 4.0

GitHubTwitterRSS