CVE-2010-0705 json
Aavmker4.sys in avast!
published 2010-02-25 16 y ago modified 2026-06-16 4 mo ago also EUVD-2010-0732
- cvss
- 7.2
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 60%
- public exploits
- 1
- Exploit-DB
Summary
Aavmker4.sys in avast! 4.8 through 4.8.1368.0 and 5.0 before 5.0.418.0 running on Windows 2000 and XP does not properly validate input to IOCTL 0xb2d60030, which allows local users to cause a denial of service (system crash) or execute arbitrary code to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption.
Timeline
- Published
- First public exploit (EDB-12406)
Exploit prediction
0.93% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-12406 Avast! 4.7 - 'aavmker4.sys' Local Privilege Escalation local, 2010-04-27
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
secunia.com
/advisories/38689
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2010/0449
vdb-entry, vendor-advisory
-
forum.avast.com
/index.php?topic=55484.0
vendor-advisory
-
secunia.com
/advisories/38677
third-party-advisory, vendor-advisory
-
securityfocus.com
/bid/38363
vdb-entry
-
osvdb.org
/62510
vdb-entry
-
securityfocus.com
/archive/1/509710/100/0/threaded
mailing-list
-
securitytracker.com
/id?1023644
vdb-entry
- trapkit.de /advisories/TKADV2010-003.txt
Sources
- CVE List CVE-2010-0705
- NVD CVE-2010-0705
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.