CVE-2025-13032 Overview
CVE-2025-13032 is a double fetch vulnerability in the sandbox kernel driver shipped with Avast and AVG Antivirus on Windows. The flaw affects versions prior to 25.3 and enables a local attacker to trigger a kernel pool overflow. Successful exploitation results in local privilege escalation from a standard user context to SYSTEM. The issue is tracked under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition and originates from the kernel-mode component reading the same user-mode memory twice without consistent validation.
Critical Impact
A local low-privileged attacker can escalate to kernel-level SYSTEM privileges by exploiting a race condition in the antivirus sandbox driver, leading to full compromise of confidentiality, integrity, and availability.
Affected Products
- Avast Antivirus for Windows, versions prior to 25.3
- AVG Antivirus for Windows, versions prior to 25.3
- Microsoft Windows hosts running the affected sandbox kernel driver
Discovery Timeline
- 2025-11-11 - CVE-2025-13032 published to the National Vulnerability Database
- 2025-12-08 - Last updated in NVD database
Technical Details for CVE-2025-13032
Vulnerability Analysis
The vulnerability resides in the sandbox kernel driver bundled with Avast and AVG Antivirus on Windows. The driver fetches data from a user-mode buffer twice while servicing a request, but does not safely capture or re-validate the value between fetches. An attacker controlling the user-mode buffer can race the kernel to swap the contents between the validation read and the use read. This classic double fetch pattern (CWE-367) allows attacker-supplied values to bypass size or boundary checks performed by the driver. The unchecked value is then used in a kernel pool allocation or memory copy, producing a pool overflow in non-paged kernel memory. Corrupting adjacent pool structures yields arbitrary kernel write primitives, which attackers chain into token replacement or kernel function pointer overwrites to obtain SYSTEM. Because the vulnerable component is a signed kernel driver loaded at boot, exploitation runs entirely within Ring 0 once triggered.
Root Cause
The root cause is unsafe handling of user-mode input by the kernel driver. The driver reads a length or pointer field from a user-supplied structure, validates it, and later re-reads the same field from user memory when performing the operation. Without copying the value to a kernel stack variable between the two accesses, a concurrent thread can change the value, defeating the check.
Attack Vector
Exploitation requires local access and a low-privileged authenticated session on the Windows host. The attacker opens a handle to the vulnerable sandbox driver and issues crafted I/O control requests while a second thread continuously mutates the input buffer. No user interaction is required beyond running the exploit binary.
No public proof-of-concept code is currently available for CVE-2025-13032. Refer to the Gen Digital Security Advisory for vendor-provided technical details.
Detection Methods for CVE-2025-13032
Indicators of Compromise
- Unexpected SYSTEM-level child processes spawned from medium-integrity or low-integrity parent processes.
- Kernel pool corruption bugchecks (BAD_POOL_HEADER, BAD_POOL_CALLER, KERNEL_SECURITY_CHECK_FAILURE) on hosts running Avast or AVG versions earlier than 25.3.
- Unsigned or suspicious processes opening handles to the Avast or AVG sandbox driver device object.
Detection Strategies
- Inventory installed Avast and AVG Antivirus versions across the fleet and flag any build below 25.3.
- Monitor for token manipulation behavior, such as a non-privileged process suddenly executing with NT AUTHORITY\SYSTEM integrity.
- Hunt for processes issuing high-frequency DeviceIoControl calls to Avast or AVG driver device objects in tight loops, a pattern consistent with double fetch race exploitation.
Monitoring Recommendations
- Forward Windows kernel crash dumps and Event ID 1001 (BugCheck) entries to a centralized log platform for correlation.
- Track creation of new services, scheduled tasks, or registry persistence shortly after antivirus driver crashes on the same host.
- Alert on integrity-level transitions where a single process lineage crosses from Medium to System without a documented elevation path.
How to Mitigate CVE-2025-13032
Immediate Actions Required
- Update Avast Antivirus and AVG Antivirus to version 25.3 or later on every affected Windows endpoint.
- Restrict local interactive logon rights on sensitive hosts to limit the population of users able to trigger the local attack vector.
- Audit endpoints for installations of vulnerable Avast or AVG builds and prioritize remediation on multi-user systems, jump hosts, and developer workstations.
Patch Information
Gen Digital has addressed the double fetch in Avast and AVG Antivirus versions 25.3 and later. The fix updates the sandbox kernel driver to capture user-supplied values into kernel-controlled storage before validation and use, eliminating the race window. Patch details are published in the Gen Digital Security Advisory.
Workarounds
- No vendor-supplied workaround is available. Applying the 25.3 update is the only supported remediation.
- Where patching is delayed, enforce application allowlisting to block unauthorized binaries from interacting with the vulnerable driver.
- Reduce local user counts and remove unnecessary local administrative tooling on shared Windows hosts until the update is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
