{
  "id": 9724485,
  "title": "CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2",
  "url": "https://urgent.news/2026/09/25/cve-2025-13032-entering-and-breaking-the-avast-antivirus-sandbox-part",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-25T07:03:46.000Z",
  "source": {
    "name": "Hacker News",
    "slug": "hacker-news",
    "url": "https://www.safateam.com/intelligence-hub/research/technical-articles/cve-2025-13032-entering-and-breaking-the-avast-antivirus-sandbox-part-2"
  },
  "original_language": "en",
  "account": "This is the second and final part of our research on exploiting CVE-2025-13032 in Avast's Antivirus sandbox on a Windows 11 system. In the first part, we covered the vulnerable double-fetch issue and how it could be used to generate a kernel pool overflow. The overflow targets the PAGED_POOL, which allows for controlled allocation size, overflow size, and content. The paged pool is a region of memory used for kernel and driver objects that do not need to be paged out to disk.\n\nWe selected the I/O Ring Object as our corruption target due to its location in PAGED_POOL, its use of user-mode buffers for I/O operations, and the fact that most Windows objects are stored in the PAGED_POOL. The IORing object maintains a submission queue of I/O operations, and the buffers tracked in the RegBuffers field are validated once at registration time and reused for subsequent operations. Corrupting these buffers provides an arbitrary kernel read/write primitive, enabling local privilege escalation to SYSTEM via token theft.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}