CVE-2010-0705

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-02-25 · updated 2026-06-16
Weakness: CWE-20

Description

Aavmker4.sys in avast! 4.8 through 4.8.1368.0 and 5.0 before 5.0.418.0 running on Windows 2000 and XP does not properly validate input to IOCTL 0xb2d60030, which allows local users to cause a denial of service (system crash) or execute arbitrary code to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption.

Affected products

Avast Antivirus Home: through 5.0.396.0; 4.8.1169, 4.8.1195, 4.8.1201, 4.8.1227, 4.8.1229, 4.8.1282 (+5)
Avast Antivirus Professional: through 5.0.396.0; 4.8.1169, 4.8.1195, 4.8.1201, 4.8.1227, 4.8.1229, 4.8.1282 (+6)

References

http://forum.avast.com/index.php?topic=55484.0
http://osvdb.org/62510
http://secunia.com/advisories/38677
http://secunia.com/advisories/38689
http://www.securityfocus.com/archive/1/509710/100/0/threaded
http://www.securityfocus.com/bid/38363
http://www.securitytracker.com/id?1023644
http://www.trapkit.de/advisories/TKADV2010-003.txt
http://www.vupen.com/english/advisories/2010/0449
http://forum.avast.com/index.php?topic=55484.0
http://osvdb.org/62510
http://secunia.com/advisories/38677

Get alerted when CVE-2010-0705 or the next vulnerability affects your stack