PT-2025-46368 · Avg+1 · Avg Antivirus+1

Safa Team · Published 2025-11-11 · Updated 2025-12-07 · CVE-2025-13032

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avast/AVG Antivirus versions prior to 25.3

Description A double fetch race condition exists in the Avast/AVG kernel sandbox driver on Windows. This condition allows a local attacker to escalate privileges through a pool overflow. The issue involves a break-in and escape from the antivirus sandbox, potentially leading to a SYSTEM token heist.

Recommendations Update Avast/AVG Antivirus to version 25.3 or later.

Fix

LPE

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2025-13032

Affected Products

Avg Antivirus

Avast Antivirus

References · 9

• https://osv.dev/vulnerability/CVE-2025-13032 · Vendor Advisory
• https://gendigital.com/us/en/contact-us/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13032 · Security Note
• https://reddit.com/r/CVEWatch/comments/1pgftjk/top_10_trending_cves_07122025 · Reddit Post
• https://twitter.com/0dayPublishing/status/1988281764549218642 · Twitter Post
• https://twitter.com/CveFindCom/status/1988331794052022325 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1pfms05/top_10_trending_cves_06122025 · Reddit Post
• https://twitter.com/SAFATeamApS/status/1996590330628448336 · Twitter Post
• https://twitter.com/CVEnew/status/1988452648241254491 · Twitter Post