A Double-Fetch Bug in Avast's Sandbox Reaches SYSTEM

A double-fetch bug in the kernel driver behind Avast and AVG's antivirus sandbox let a local attacker with no special privileges reach full SYSTEM access on a fully updated Windows 11 machine, according to a two-part technical writeup security firm SAFA Team completed Sept. 18.

The flaw, CVE-2025-13032, carries a CVSS 3.1 score of 7.8 and affects Avast and AVG Antivirus for Windows in versions before 25.3, according to SentinelOne's vulnerability database. The vector SentinelOne lists, AV:L/AC:L/PR:L/UI:N, sets the preconditions: an attacker needs to already be running code locally, with low privileges, on the target machine, and needs no action from a user. It is a privilege-escalation bug, not a way in on its own; it turns an attacker who already has a foothold into one with full control. SAFA Team found it by searching Avast's aswSnx.sys driver for calls to ProbeForRead, a Windows kernel function that signals code is about to read memory supplied by a regular user process, and tracing which of those reads checked their input twice instead of once, a pattern known as a double fetch or a time-of-check-to-time-of-use flaw.

How a length field read twice becomes a pool overflow

The bug lives in an IOCTL handler inside aswSnx, the driver behind Avast's Sandbox feature, which is meant to run an untrusted program in an isolated copy of the file system and registry so it cannot touch the real one, according to SAFA Team's first writeup. The handler reads the length field of a UNICODE_STRING structure supplied by the sandboxed process, allocates a paged pool buffer sized to that length, then reads the same length field a second time before copying data into the buffer. A malicious process can shrink the buffer's declared size for the first read and grow it before the second, so the driver copies more data than it allocated space for, corrupting adjacent kernel heap memory. The bug sits inside the very feature meant to contain untrusted code, so the isolation Avast's Sandbox promises is also what hands an attacker a foothold to attack from.

From a heap overflow to a SYSTEM token

SAFA Team's second writeup, published the same day, describes turning that overflow into a working exploit: corrupting the RegBuffers array inside a Windows IORing object, a kernel structure Windows uses to batch I/O requests, to gain an arbitrary kernel read and write primitive; leaking a kernel address by inspecting a memory descriptor list, a structure the kernel uses to track physical memory pages; and finally stealing the access token from a SYSTEM-level process to escalate a standard account to full administrative control. The chain runs on a fully updated Windows 11 system, meaning Microsoft's own patches offered no protection against a flaw in third-party security software running with kernel privileges. SAFA Team's writeup also documents the repair work needed to avoid crashing the machine during teardown, a step an exploit needs to survive if the attacker wants to keep using the computer afterward rather than just proving the bug is real.

Date	Event
March 14, 2025	SAFA Team submits reports via Bugcrowd
March 18, 2025	Avast marks the submissions as duplicates
April 1, 2025	Avast ships patches for most of the flaws
June 5, 2025	Final variant confirmed patched
Nov. 11, 2025	CVE-2025-13032 is officially published
Sept. 18, 2026	SAFA Team publishes the full exploit chain

A disclosure that outran its own bounty program

Avast's own version numbering puts the fix at 25.3, per SentinelOne's tracking, with SAFA Team's testing referencing a vulnerable build as recent as 25.2.9898.0. Most of the four kernel heap overflow bugs and two local denial-of-service issues SAFA Team found in the same audit were fixed within about 12 days of Avast accepting the reports, according to Cyber Security News's coverage published Dec. 6, 2025, a pace that makes the ten-month gap between patch and public writeup look more like a coordinated embargo than negligence. Avast has not published its own advisory naming CVE-2025-13032, and neither SAFA Team's writeup nor SentinelOne's entry says whether Avast paid a bounty for the report.

Avast, AVG and roughly 500 million other accounts

Avast and AVG have shared a parent company since Sept. 12, 2022, when NortonLifeLock completed its acquisition of Avast and renamed itself Gen Digital, according to the merger completion announcement. Gen Digital's chief executive said at the time that half a billion users trusted the combined company's products, which now include Norton, Avast, AVG, Avira, CCleaner and LifeLock. A kernel driver bug in Avast's sandbox does not automatically touch every one of those brands, since each keeps its own codebase, but it lands inside a company whose antivirus products between them run with kernel-level trust on a share of the half a billion accounts Gen Digital counts across its whole portfolio.

What this means for a patched machine

Because Avast fixed the underlying bug within about two weeks of the March 2025 report, the practical risk today is narrow: it applies only to a machine still running Avast or AVG Antivirus for Windows below version 25.3, a build most consumer installations would have moved past long before SAFA Team's public writeup gave attackers a working blueprint. What survives the patch is the method, not the bug. Grepping a driver for ProbeForRead calls and checking each one for a repeated read is generic enough to apply to any Windows security product's kernel driver, not just Avast's, the same kind of systematic search Trail of Bits ran against Miden's cryptography code, reported Sept. 25, using AI agents rather than a manual grep. It is also the same driver-level trust problem underlying a Windows file-notification side channel published Sept. 25, where an entirely different Windows subsystem leaked private data to a local, unprivileged process without needing a kernel driver at all.