Security researchers from the SAFA Team have published a technical analysis detailing the exploitation of CVE-2025-13032, a kernel heap overflow vulnerability found within the Avast Antivirus software. The research focuses on the 'aswSnx' kernel driver, which exposes a wide interface of IOCTL (Input/Output Control) handlers to user-mode applications. By identifying a double-fetch flaw in how the driver processes user-supplied data, the researchers were able to trigger a heap overflow in the Windows paged pool. This vulnerability occurs when the driver fetches a length field multiple times from user-controlled memory, allowing an attacker to manipulate the value between the initial buffer allocation and the subsequent memory copy operation. To exploit this, the researchers employed a heap spraying strategy to reliably place their malicious buffer adjacent to an I/O Ring object. By corrupting the 'RegBuffers' array within this object, they gained an arbitrary kernel read/write primitive. This primitive was then used to leak kernel addresses and ultimately perform a token theft, elevating the attacker's privileges to the SYSTEM level on a fully updated Windows 11 system. The researchers noted that modern Windows kernel mitigations, such as user-mode accessors, are designed to prevent such exploitation techniques by verifying that user-mode buffers reside in the correct memory space.
The researchers from the SAFA Team provided a detailed technical breakdown of the vulnerability, which is summarized in this visual representation of the exploit chain.