CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2

Explains a practical end-to-end exploit of CVE-2025-13032, a double-fetch bug in an Avast kernel driver on Windows 11 that allows a paged-pool overflow. The vulnerability arises because the driver reads a user-supplied _UNICODE_STRING->Length twice: once to allocate a buffer (ExAllocatePoolWithTag) and again to memmove the string, so a racing thread toggling Length between a small and a large value produces a controlled overflow. The writeup details timing, how the segemented Windows pool allocator (LFH vs VS) affects spray strategy, and notes that newer kernels using user-mode accessors mitigate the described technique.

Shows how the overflow is weaponized into an arbitrary kernel read/write by targeting the I/O ring’s RegBuffers array, which resides in paged pool and whose size is precisely controlled by registering N buffers (N pointers × 8 bytes). Corrupting a single RegBuffers pointer is enough to hijack buffer metadata; the exploit combines a heap spray of IOP_MC_BUFFER_ENTRY allocations, an MDL-based kernel address leak via MDL introspection, and careful teardown fixes to avoid blue screens. The chain concludes with token theft to escalate to SYSTEM. Implementation specifics, structure layouts, spray rationale, and references to prior I/O-ring exploitation work are provided to reproduce and understand each step.