Researcher Chaotic Eclipse Publishes Proof‑of‑Concept Exploit for Avast Antivirus Privilege‑Escalation Flaw

Security researcher Chaotic Eclipse, also known by the monikers INFINITE NIGHTMARE, MSNightmare and Nightmare‑Eclipse, has released a proof‑of‑concept (PoC) named "PrettyPrague" that demonstrates a zero‑day elevation‑of‑privileges vulnerability in GenDigital's Avast Antivirus software.

The exploit, first reported by Security Affairs, shows how an attacker with limited user rights can gain higher system privileges by leveraging a flaw in Avast's kernel‑mode driver. The vulnerability resides in the way the antivirus component interacts with Windows kernel structures, allowing crafted inputs to trigger arbitrary code execution with system‑level rights.

Avast, now part of the GenDigital portfolio after a series of mergers, is widely deployed on both consumer and enterprise devices. A privilege‑escalation bug in such a ubiquitous security product is significant because it can effectively bypass the very defenses it is meant to provide, potentially opening the door to further malware installation, data exfiltration, or persistent footholds on compromised machines.

While Chaotic Eclipse has not disclosed a CVE identifier, the public release of the PoC puts pressure on the vendor to address the issue promptly. Historically, zero‑day exploits that are publicly shared tend to accelerate patch cycles, as vendors must mitigate the risk before widespread exploitation occurs. Security analysts anticipate that GenDigital will issue an advisory and a corresponding update within days, following standard industry practice.

The emergence of this exploit highlights a broader trend where antivirus and endpoint‑protection solutions, once considered a defensive baseline, become attractive targets for attackers seeking to subvert security controls from within. Researchers and security teams are reminded to monitor vendor advisories, apply patches swiftly, and consider layered defenses that limit the impact of any single component being compromised.

Industry observers note that the naming of the PoC—"PrettyPrague"—fits Chaotic Eclipse's pattern of using evocative titles for high‑impact findings. The researcher’s previous work, under aliases such as MSNightmare, has uncovered critical vulnerabilities in other security products, reinforcing a reputation for focusing on the intersection of privilege escalation and system integrity.

In the meantime, organizations using Avast or other GenDigital products are advised to review their patch management policies, ensure that automatic updates are enabled, and, where feasible, apply temporary mitigations such as restricting driver loading permissions until an official fix is released.

As the cybersecurity community watches the vendor’s response, the PrettyPrague PoC serves as a reminder that even tools designed to protect users can harbor exploitable flaws, underscoring the need for continuous vigilance and rapid remediation in the face of emerging threats.