CVE-2021-27241: 
Avast Premium Security vulnerability analysis and mitigation

CVE-2021-27241 is a vulnerability discovered in Avast Premium Security 20.8.2429 (Build 20.8.5653.561) that allows local attackers to delete arbitrary directories. The vulnerability was discovered by Abdelhamid Naceri and was disclosed on February 24, 2021 (ZDI Advisory).

The vulnerability exists within the AvastSvc.exe module. The specific flaw allows attackers to abuse the service by creating a directory junction to delete arbitrary directories. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H (NVD).

An attacker can leverage this vulnerability to create a denial-of-service condition on the system by deleting arbitrary directories. The attack requires local access and the ability to execute low-privileged code on the target system (ZDI Advisory).

To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system. The attack can then be carried out by creating a directory junction to abuse the service's functionality (ZDI Advisory).

The vulnerability has been fixed in Avast version 20.10 (ZDI Advisory).