Loading vulnerability…
Privilege Escalation in Avast/AVG Antivirus Sandbox Kernel Driver
CVE-2025-13032 is a double-fetch vulnerability in the sandbox kernel driver of Avast and AVG Antivirus on Windows versions earlier than 25.3. A local attacker can race the driver’s handling of data to cause a pool overflow, escape the antivirus sandbox, and elevate privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a local attacker to escape the Avast Antivirus sandbox and obtain NT AUTHORITY\SYSTEM privileges on Windows, resulting in complete administrative control of the affected host.
If you can’t patch tonight, do this now.
No separate vendor mitigation is specified. Until patched, restrict untrusted code execution and local interactive access on affected Windows endpoints, since exploitation requires local attacker-controlled activity.
Patch, then assume compromise.
Update Avast or AVG Antivirus to a vendor-supplied version later than 25.3, apply the available vendor patches, and restart the system after updating.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.