CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2

This is the second and final part of our research on exploiting CVE-2025-13032 in Avast's Antivirus sandbox on a Windows 11 system. In the first part, we covered the vulnerable double-fetch issue and how it could be used to generate a kernel pool overflow. The overflow targets the PAGED_POOL, which allows for controlled allocation size, overflow size, and content. The paged pool is a region of memory used for kernel and driver objects that do not need to be paged out to disk.

We selected the I/O Ring Object as our corruption target due to its location in PAGED_POOL, its use of user-mode buffers for I/O operations, and the fact that most Windows objects are stored in the PAGED_POOL. The IORing object maintains a submission queue of I/O operations, and the buffers tracked in the RegBuffers field are validated once at registration time and reused for subsequent operations.

Corrupting these buffers provides an arbitrary kernel read/write primitive, enabling local privilege escalation to SYSTEM via token theft.