CVE-2009-3523

no score yetEPSS 0.8%

aavmKer4.sys in avast! Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1) 0xb2d6000c and (2) 0xb2d60034, which allows local users to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption, a different vulnerability than CVE-2008-1625.

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2009-10-01
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

avast:avast_antivirus_home
avast:avast_antivirus_professional

References

http://secunia.com/advisories/36858
http://www.avast.com/eng/avast-4-home_pro-revision-history.html
http://www.ntinternals.org/ntiadv0904/ntiadv0904.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6024
http://secunia.com/advisories/36858

Check your stack JSON