CVE-2022-26523

5.3 mediumEPSS 0.2%

Medium (5.3). EPSS 0.2% chance of exploitation in the next 30 days.

The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) due to a double fetch vulnerability at aswArPot+0xbb94.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-400
Published: 2026-05-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.avast.com/bug-bounty
https://www.sentinelone.com/labs/vulnerabilities-in-avast-and-avg-put-millions-at-risk/

Check your stack JSON