CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2
SafeTeam details full exploitation of CVE-2025-13032, a double-fetch bug in Avast's kernel driver, achieving kernel read/write and Windows 11 privilege escalation.
The write-up explains how a double-fetch on the Length field of a user-supplied _UNICODE_STRING in Avast's kernel driver causes a PAGED_POOL overflow, won by racing a second thread that toggles the value. The authors corrupt the RegBuffers array of a Windows I/O Ring object to obtain an arbitrary kernel read/write primitive and local privilege escalation on an up-to-date Windows 11 system. They note that Microsoft's new user-mode accessors mitigation in recent Windows kernels blocks this specific exploitation technique.
- Double-fetch on UNICODE_STRING Length enables controlled paged pool overflow
- Corrupting I/O Ring RegBuffers array yields arbitrary kernel read/write
- LPE demonstrated on up-to-date Windows 11
- User-mode accessors mitigation now prevents the described technique
- CVEs
- CVE-2025-13032
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-13032 | Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflow | 7.8 | <1% |
From the original article
14 min read at safateam.com
This blogpost is the second and final part of our Avast research and will focus on the exploitation of CVE-2025-13032, a double-fetch vulnerability we discovered in Avast’s kernel driver. This post recaps the bug and walks through how we exploited it on an up-to-date Windows 11 system at the time of the finding. Feel free to read the first part if you missed it → https://www.
By safateam · safateam.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.