← Saturday, September 26, 2026SecurityVulnerability

Avast driver exploit turns a double-fetch flaw into SYSTEM access on Windows 11

safateam.com 15 min read Editor score 7/10

The exploit chain turns a double-fetch bug in Avast’s kernel driver into an arbitrary kernel read/write primitive, then escalates to SYSTEM through token theft. Its heap-spray and cleanup details offer useful lessons for kernel exploit mitigations, though it concerns one product.

What

Avast’s Windows kernel driver double-fetches a user-supplied UNICODE_STRING length, enabling a paged-pool overflow.

How

The exploit turns the overflow into arbitrary kernel read/write by corrupting IORing’s RegBuffers, then steals a token for SYSTEM.

Why it matters

Kernel code handling user memory needs stable validated values; newer user-mode accessors block the technique described.

Read on safateam.com → Hacker News · 30 comments

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.