CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2

Automated excerpt

When the kernel performs an I/O operation using that entry, it will dereference our fake structure directly — reading the `Address` field from userland and using it as the r/w target. Because the MDL describes a userland address, the kernel needs to track which process owns that memory, so the MDL stores a pointer to the owning process’s _EPROCESS structure in its Process field: 1struct _MDL2{3[... ]4 _EPROCESS *Process;5[...

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.