CVE-2025-13032General(avast / antivirus)

LOWCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch avast antivirus systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflow.

avast CVEs Back to dashboard

2.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.gendigital.com/us/en/contact-us/security-advisories/

Weakness type (CWE)

CWE-367

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

RISING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

antivirus
windows

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
12 mentions across 4 observed days
Momentum state: rising

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
General: 6 classified signals
Disclosure: 4 classified signals
Peaked 1d ago at 9 mentions (2026-09-25); latest day: 1
12 total mentions across 4 days

Affected systems

Vendors

avast microsoft

Products

antiviruswindows

1 version affected across 2 products

Deep dive

Activity timeline12 mentions / 4d

Signal classification4 categories

General

650.0%

Disclosure

433.3%

Patch

18.3%

PoC

18.3%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-21	1	Patch1
2026-09-22	1	General1
2026-09-25	9	Disclosure4General4PoC1
2026-09-26	1	General1

Full discourse12 posts

SAFA Team@SAFATeamApS45d
Patch
Part 2 of our CVE-2025-13032 research is live. From a paged pool overflow to full LPE on Windows 11: IORing RegBuffers corruption, MDL-based kernel address leak, and SYSTEM token theft. CVE is patched. Full write-up: https://www.safateam.com/intelligence-hub/research/technical-articles/cve-2025-13032-entering-and-breaking-the-avast-antivirus-sandbox-part-2
Post summary
The text announces research on CVE-2025-13032, detailing technical exploitation from a paged pool overflow to Windows 11 LPE (via SYSTEM token theft), confirms the CVE is patched, and links to a full technical write-up.
014028102.4K
479 followersView on X
Nicolas Krassas@Dinosn41d
Disclosure
CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2 https://www.safateam.com/intelligence-hub/research/technical-articles/cve-2025-13032-entering-and-breaking-the-avast-antivirus-sandbox-part-2
Post summary
The text announces CVE-2025-13032 with a title indicating research into bypassing the Avast Antivirus Sandbox but contains no exploit code, remediation, or specific technical details.
0601764.0K
162.5K followersView on X
/r/netsec@_r_netsec41d
Disclosure
CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2 https://www.safateam.com/intelligence-hub/research/technical-articles/cve-2025-13032-entering-and-breaking-the-avast-antivirus-sandbox-part-2
Post summary
The text announces CVE-2025-13032 with a link to a technical research article detailing an Avast Antivirus sandbox escape (Part 2). It discloses the vulnerability type but includes no exploit code, remediation, or evidence of active exploitation.
040341.2K
34.3K followersView on X
Frank@jedisct141d
General
CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2 https://www.safateam.com/intelligence-hub/research/technical-articles/cve-2025-13032-entering-and-breaking-the-avast-antivirus-sandbox-part-2
Post summary
The text mentions CVE-2025-13032 and links to an article about breaking the Avast sandbox, but lacks explicit indicators of PoC, exploit code, active exploitation, patches, or technical details.
00021828
18.2K followersView on X
Ring3API 🇺🇦@ntlmrelay44d
General
Top 5 most shared links in my network (Sep 21): 1. https://blog.trailofbits.com/2026/09/21/saml-a-fractal-of-bad-design/ (5 people) 2. https://github.com/Bert-JanP/EntraTrace (5 people) 3. https://github.com/MSNightmare/BigDiskBuster (5 people) 4. https://projectzero.google/2026/09/windows-dangling-com.html (5 people) 5. https://www.safateam.com/intelligence-hub/research/technical-articles/cve-2025-13032-entering-and-breaking-the-avast-antivirus-sandbox-part-2 (5 people) #cybersecurity #blueteam
Post summary
The tweet lists top shared links, including one referencing CVE-2025-13032, but contains no specific details about the vulnerability, exploitation, or remediation.
00021315
6.7K followersView on X
✪ 𝕱𝖆𝖍𝖆𝖉@fad_77740d
General
تحليل CVE-2025-13032 يسلّط الضوء على نقطة حساسة: صندوق الحماية في مضاد الفيروسات ليس حدودًا أمنية مطلقة. أهمية هذا النوع من الأبحاث تكمن في أنه يختبر طبقات العزل داخل Avast Antivirus Sandbox، وهي طبقات يُفترض أن تقلّل أثر تنفيذ الملفات غير الموثوقة. القيمة التقنية هنا ليست في الثغرة فقط، بل في فهم كيف يمكن لسلاسل الاستغلال أن تتعامل مع بيئات التحليل والعزل داخل منتجات الحماية. عمليًا، هذا يهم فرق الأمن، باحثي الثغرات، ومطوري منتجات الحماية عند تقييم افتراضات العزل، تقليل سطح الهجوم، وتحسين نماذج التهديد. ما الافتراض الأمني الأكثر خطورة عند تصميم Sandbox داخل منتج حماية؟ CVE-2025-13032 is a reminder that antivirus sandboxes should be treated as attack surfaces, not just defensive boundaries. This research matters because it focuses on Avast Antivirus Sandbox isolation, where untrusted code is expected to be contained and observed safely. The technical value is in examining how sandbox boundaries can be challenged, and what that means for exploit research, malware analysis, and endpoint security design. For security teams and product engineers, the practical takeaway is clear: sandbox design needs continuous threat modeling, hardening, and validation against real escape paths. Which sandbox isolation assumption deserves the most scrutiny in endpoint security products? https://www.safateam.com/intelligence-hub/research/technical-articles/cve-2025-13032-entering-and-breaking-the-avast-antivirus-sandbox-part-2 #CVE #SandboxSecurity #EndpointSecurity
Post summary
The tweet references CVE-2025-13032 in the context of Avast Antivirus sandbox isolation research, emphasizing sandboxes as attack surfaces, but lacks explicit technical vulnerability details, exploit code, patch information, or active exploitation reports.
0001167
93 followersView on X
Hacker News 50@betterhn5041d
General
CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2 https://www.safateam.com/intelligence-hub/research/technical-articles/cve-2025-13032-entering-and-breaking-the-avast-antivirus-sandbox-part-2 (https://news.ycombinator.com/item?id=49841115)
Post summary
The text merely references CVE-2025-13032 with a title and link to a research article and provides no further details on PoC, exploit, active exploitation, patches, or technical specifics.
1000064
2.2K followersView on X
Elfi@EAnad0r41d
PoC
SAFA just published part 2 of their CVE-2025-13032 write-up: the full exploit chain for the double-fetch in Avast's sandbox kernel driver. Pool overflow, corrupt the IORing RegBuffers array, get arbitrary kernel read/write, steal the SYSTEM token on Windows 11. The irony is the vulnerable IOCTLs only answer to sandboxed processes, so they had to register their own process INTO the sandbox first.
Post summary
The post announces a detailed write-up of the exploit chain for CVE-2025-13032, outlining kernel-level exploitation techniques without naming a specific tool or patch.
1000066
75 followersView on X
Hacker News 20@betterhn2041d
General
CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2 https://www.safateam.com/intelligence-hub/research/technical-articles/cve-2025-13032-entering-and-breaking-the-avast-antivirus-sandbox-part-2 (https://news.ycombinator.com/item?id=49841115)
Post summary
The tweet text only references CVE-2025-13032 and a linked research article titled 'Entering and Breaking the Avast Antivirus Sandbox Part 2'; it provides no explicit indicators regarding PoC, exploit tools, active exploitation, patches, technical vulnerability details, or false-positive claims within the tweet text itself.
1000087
3.1K followersView on X
Elfi@EAnad0r41d
Disclosure
Write-up: https://www.safateam.com/intelligence-hub/research/technical-articles/cve-2025-13032-entering-and-breaking-the-avast-antivirus-sandbox-part-2
Post summary
The text is a minimal reference to a write-up about CVE-2025-13032, providing only a link without PoC, exploit code, active exploitation evidence, patches, or technical specifics.
0000033
75 followersView on X
HackerNewsTop5@hackernewstop541d
General
CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2 #HackerNews https://www.safateam.com/intelligence-hub/research/technical-articles/cve-2025-13032-entering-and-breaking-the-avast-antivirus-sandbox-part-2 https://t.co/khFMalGtHd
Post summary
The tweet references CVE‑2025‑13032 and links to a research article, but provides no explicit PoC, exploit tool, active exploitation claim, patch information, technical details, or false‑positive indication.
0000079
884 followersView on X
NewsTongue@NewsTongueX41d
Disclosure
🔴 CVE-2025-13032: Double-fetch flaw in Avast kernel driver enables privilege escalation on Windows 11 Researchers disclosed a double-fetch vulnerability in Avast Antivirus's kernel driver that allows local privilege escalation to SYSTEM on fully patched Windows 11 systems. The bug occurs in code capturing Unicode strings: the kernel reads the Length field twice—once to allocate a buffer, again to copy data.
Post summary
Researchers disclosed CVE-2025-13032, a double-fetch kernel driver flaw in Avast Antivirus enabling local privilege escalation to SYSTEM on Windows 11, with technical details describing the kernel reading the Length field twice during buffer allocation and data copy.
0000055
949 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	avast	antivirus	-	-	-
OS	microsoft	windows	-	-	-

Explore more

Back to dashboard avast CVEs microsoft CVEs antivirus vulnerabilities

What researchers are saying

CVE-2025-13032

Nicolas Krassas[verified]@DinosnDisclosure

The text announces CVE-2025-13032 with a title indicating research into bypassing the Avast Antivirus Sandbox but contains no exploit code, remediation, or specific technical details.

Frank[verified]@jedisct1General

The text mentions CVE-2025-13032 and links to an article about breaking the Avast sandbox, but lacks explicit indicators of PoC, exploit code, active exploitation, patches, or technical details.

Ring3API 🇺🇦[verified]@ntlmrelayGeneral

The tweet lists top shared links, including one referencing CVE-2025-13032, but contains no specific details about the vulnerability, exploitation, or remediation.

✪ 𝕱𝖆𝖍𝖆𝖉[verified]@fad_777General

The tweet references CVE-2025-13032 in the context of Avast Antivirus sandbox isolation research, emphasizing sandboxes as attack surfaces, but lacks explicit technical vulnerability details, exploit code, patch information, or active exploitation reports.

Elfi[verified]@EAnad0rPoC

The post announces a detailed write-up of the exploit chain for CVE-2025-13032, outlining kernel-level exploitation techniques without naming a specific tool or patch.

Elfi[verified]@EAnad0rDisclosure

The text is a minimal reference to a write-up about CVE-2025-13032, providing only a link without PoC, exploit code, active exploitation evidence, patches, or technical specifics.

NewsTongue[verified]@NewsTongueXDisclosure

Researchers disclosed CVE-2025-13032, a double-fetch kernel driver flaw in Avast Antivirus enabling local privilege escalation to SYSTEM on Windows 11, with technical details describing the kernel reading the Length field twice during buffer allocation and data copy.

SAFA Team@SAFATeamApSPatch

The text announces research on CVE-2025-13032, detailing technical exploitation from a paged pool overflow to Windows 11 LPE (via SYSTEM token theft), confirms the CVE is patched, and links to a full technical write-up.