Technical impact
The vulnerability allows a local attacker to trigger a double‑fetch condition in the aswArPot.sys driver, enabling arbitrary code execution in kernel mode or causing a denial of service through memory corruption and OS crash. This results in complete system compromise or interruption of service, as the kernel can be hijacked to perform privileged operations. The weakness is a double‑fetch condition (CWE‑367).
Affected Systems
Systems running Avast or AVG Windows Anti‑Rootkit drivers prior to version 22.1 are affected. The vulnerable driver, aswArPot.sys, is installed on Windows machines that have the legacy Avast/AVG anti‑rootkit component enabled.
Risk and Exploitability
Exploitability is limited to local attackers with execution privileges on the host, and the EPSS score of 2% indicates a low to moderate probability of exploitation. The CVSS score of 7.8 indicates high severity, underscoring the potential for full kernel compromise. KEV is not listed. Attackers could install rootkits or bypass system defenses if they can run code locally. The risk is considered high while the attack vector remains local.
