CVE-2023-5760: 
AVG Antivirus vulnerability analysis and mitigation

A time-of-check to time-of-use (TOCTOU) bug was discovered in the handling of IOCTL (input/output control) requests in Avast/AVG Antivirus version 23.8. The vulnerability was disclosed in November 2023 and assigned identifier CVE-2023-5760 (NVD, Norton Advisory).

The vulnerability is classified as a time-of-check to time-of-use (TOCTOU) race condition, identified as CWE-367. The CVSS v3.1 base score is rated as HIGH with a score of 7.0 (Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) according to NVD's assessment, while NortonLifeLock assigned it a score of 8.2 (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) (NVD).

The vulnerability leads to an out-of-bounds write condition which can be exploited to gain full local privilege escalation on the affected system. This means an attacker could potentially elevate their privileges to gain complete control over the compromised system (Norton Advisory).

The vulnerability was fixed with the release of Avast/AVG Antivirus version 23.9. Users are encouraged to ensure their security software is always updated to the latest version available (Norton Advisory).