CVE-2022-26523
Published: April 11, 2026· Updated: May 8, 2026
Official Description
The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) due to a double fetch vulnerability at aswArPot+0xbb94.
Risk Analysis
This medium-severity vulnerability (CVSS 5.3) in Avast and AVG Windows Anti Rootkit driver (aswArPot.sys before 22.1) allows a local attacker to execute arbitrary code in kernel mode or cause a denial of service. The flaw is a double fetch vulnerability. Its active exploitation in the wild and inclusion in CISA's KEV catalog make it an urgent threat, as it could lead to system compromise or instability.
This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities Catalog, indicating a significant threat, despite requiring local access.
Update Avast and AVG Windows Anti Rootkit drivers to version 22.1 or newer immediately. Regularly update all security software to protect against known exploited vulnerabilities.
Technical Analysis
CVE-2022-26523 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2022-26523 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2022-26523 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1