CVE-2026-80303

An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causing a system crash. The WFP callout driver processes network stream data and computes length values for packet fragment reassembly. The length calculation does not properly validate input stream sizes against expected boundaries. When processing specially crafted input, the length computation underflows, resulting in allocation or buffer access with an extremely large wrapped-around size value. The underflow can be triggered remotely via network traffic destined for the filtered port, or locally via crafted data provided to the filtering interface. The resulting memory allocation failure or out-of-bounds access causes a kernel panic and system crash.

• CWE-191
• CWE-248

• https://support.avast.com/en-us/article/Update-Antivirus
• https://support.avg.com/SupportArticleView?l=en&urlname=Update-AVG-Antivirus
• https://support.norton.com/sp/en/us/home/current/solutions/v20240108175512167
• https://www.gendigital.com/us/en/contact-us/security-advisories/

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8028A vulnerability was detected in FlowiseAI Flowise up to 3.0.…3.7
• CVE-2026-8029The ZTE Smart Life app contains an SQL injection vulnerabili…3.9
• CVE-2026-80298Improper neutralization of special elements used in an SQL c…8.8
• CVE-2026-8030GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-80301Improper isolation in the Avast sandbox on Windows allows a …
• CVE-2026-80302Insufficient isolation in the Avast sandbox file virtualizat…
• CVE-2026-8031A vulnerability was detected in PicoTronica e-Clinic Healthc…5.3
• CVE-2026-80311The Stripe Payment Forms by WP Full Pay WordPress plugin be…4.3
• CVE-2026-80312Improper Authentication vulnerability in Apache Camel OAuth …8.2
• CVE-2026-8032A flaw has been found in PicoTronica e-Clinic Healthcare Sys…7.3
• CVE-2026-80327An open redirect vulnerability exists in the PingGateway Fra…5.1
• CVE-2026-8033A vulnerability has been found in PicoTronica e-Clinic Healt…5.3