CVE-2022-26522 Details

A double fetch vulnerability has been identified in the Avast and AVG Windows Anti-Rootkit driver, specifically in the socket connection handler of the kernel driver aswArPot.sys, prior to version 22.1. This vulnerability allows local attackers to execute arbitrary code in kernel mode or cause a denial-of-service by corrupting memory and crashing the operating system. The issue arises because the vulnerable function fetches a user-controlled length value twice, creating a race condition that attackers can exploit to manipulate the length variable and execute arbitrary code.

Users of Avast and AVG will receive the patch to version 22.1 automatically, but those with air-gapped or on-premise installations should apply the patch as soon as possible.