CVE-2025-13032

The vulnerability (CWE-367 — race condition resulting from double fetch of a shared resource) occurs because the kernel driver handling the sandbox performs a double read of a value from user memory without locking it first. An attacker can modify this value between the first and second read, causing data inconsistency and triggering a kernel pool buffer overflow. The result is the ability to execute code with kernel-level privileges.

A local attacker can obtain full system privileges (privilege escalation to kernel level), giving them complete control over the operating system, including the ability to bypass protective mechanisms and install malicious software.

Avast Antivirus or AVG Antivirus must be updated to version 25.3 or later. Detailed information is available in the vendor's security advisory at: https://www.gendigital.com/us/en/contact-us/security-advisories/

Avast Antivirus and AVG Antivirus versions below 25.3 installed on Microsoft Windows systems.