How to Fix CVE-2026-27749: Avira Internet Security (Bundle Sibling)

By Sai Kiran Pandrala. Last verified: 2026-05-25.

CVE-2026-27749 is a sibling vulnerability in the same vendor advisory as CVE-2026-27748. Apply the same patched build and you close both. The technical detail below is what differs.

What's different about CVE-2026-27749?

Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.exe process, which runs with SYSTEM privileges, deserializes data from a file located in C:\\ProgramData using .NET BinaryFormatter without implementing input validation or deserialization safeguards. Because the file can be created or modified by a local user in default configurations, an attacker can supply a crafted serialized payload that is deserialized by the privileged process, resulting in arbitrary code execution as SYSTEM.

How to fix CVE-2026-27749

Apply the patched build per the primary write-up: How to Fix CVE-2026-27748. All commands, verification steps, and rollback notes for Avira Internet Security are listed there.

Frequently asked questions

Does the CVE-2026-27748 patch close CVE-2026-27749?

Yes. Both CVEs are addressed by the same vendor patch. Applying the patched build closes the full bundle.

Is CVE-2026-27749 listed in CISA KEV?

No public KEV listing at the time of this writing.

Where is the official advisory?

See https://www.gendigital.com/us/en/contact-us/security-advisories/

References

• Official vendor advisory: https://www.gendigital.com/us/en/contact-us/security-advisories/
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-27749
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Primary: How to Fix CVE-2026-27748

*Written by Sai Kiran Pandrala. Part of the Avira Internet Security bundle. Full procedure at how-to-fix-cve-2026-27748.*