Avast Antivirus Sandbox Hacked via Double-Fetch Bug in Kernel Driver
CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2
Researchers detail CVE-2025-13032, a double-fetch flaw in Avast's kernel driver that triggers a paged pool overflow. By racing two threads to toggle a UNICODE_STRING length, they corrupt an I/O Ring object's RegBuffers array, gaining arbitrary kernel read/write and escalating to SYSTEM on Windows 11. The exploit is reliable despite modern mitigations.
The race window is narrow but can be won reliably within a modest number of iterations.
- fathermarz
I have lost faith in signature AV and CVE feeds for that matter. Attackers test against scanners until they come back clean and avoid known fingerprints. The only way I see to catch things now is behaviour diffing through static analysis.
Disclosure: I build Vigilance, which does this.
- x-complexity
Chalk another one up for "Antiviruses causing more problems than solving them".
They 'worked' when they initially just scanned files for known malicious signatures. Now they're the equivalent of a sledgehammer to a wall with all of the extra bells & whistles strapped to them.
Application whitelisting is the remaining way forward if you actually care about runtime security. That & locking every access point down to the bare minimum.
- wzdd
That's an impressively tight TOCTOU exploit!