Introduction
A local attacker reaching kernel level on a fully patched Windows system through a mainstream antivirus product is a serious problem for defenders and enterprise administrators. CVE-2025-3500, a critical integer overflow in the aswbidsdriver kernel driver of Avast Antivirus, lets local attackers gain SYSTEM privileges. Avast, now part of Gen Digital Inc., is a major consumer security vendor with over 400 million users worldwide. With that install base and a kernel-level impact, organizations and individuals who rely on Avast for endpoint protection should treat this as a high-priority issue.
Technical information
The flaw is in the aswbidsdriver kernel driver that ships with Avast Antivirus for Windows. The driver does not properly validate user-supplied data before using it in the arithmetic that calculates buffer sizes for memory allocation. When it processes IOCTL requests, it uses input values directly in those calculations without checking that they stay within safe bounds. An attacker who sends a crafted IOCTL request with values chosen to overflow the integer gets a buffer much smaller than intended. Later operations still assume the original size, so they can write past the buffer into adjacent kernel memory and cause a heap-based buffer overflow.
The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound). Exploitation requires local access but is otherwise low complexity. A low-privileged user who exploits it can execute arbitrary code in kernel mode, which amounts to full control of the system. The vulnerable code handles IOCTL requests to aswbidsdriver, and affected Avast versions load that driver by default.
Affected systems and versions
- Product: Avast Antivirus for Windows
- Affected versions: 25.1.981.6 up to but not including 25.3.9983.922
- Vulnerable component: the aswbidsdriver kernel driver shipped with these versions
- Scope: all default installations of Avast Antivirus in this version range
Vendor security history
Avast has had several notable kernel driver vulnerabilities in recent years. CVE-2022-26522 and CVE-2022-26523, both discovered in 2022, were privilege escalation flaws in the aswArPot.sys anti-rootkit driver. They also came from improper validation of user input, and ransomware groups exploited them in the wild with bring-your-own-vulnerable-driver techniques. Avast patched CVE-2025-3500 within weeks of disclosure, which is a relatively prompt response. The recurrence of similar flaws, though, suggests ongoing difficulty with secure driver development and code auditing.
