CVE-2009-3523: aavmKer4.sys in avast!

Security readout for executives and security teams

CVE-2009-3523 is a local privilege escalation issue in the avast! Windows kernel driver aavmKer4.sys. A user who already has local access could potentially gain higher privileges through malformed driver control requests. It matters mainly on legacy Windows systems still running avast! Home or Professional before 4.8.1356. Exposure is likely limited to older Windows endpoints with avast! Home or Professional versions earlier than 4.8.1356 installed. Organizations using current supported antivirus products are unlikely to be affected, but legacy machines, lab systems, or unmanaged endpoints should be checked. Prioritize cleanup if legacy avast! 4.x exists in the environment. The issue is old and local-only, but kernel-level privilege escalation can turn a low-privilege foothold into full system control on affected machines. Mitigation focus: Upgrade affected avast! Home or Professional installations to 4.8.1356 or later.; Replace unsupported legacy avast! 4.x installations with a supported security product.; Check vendor revision history and advisories for product-specific remediation guidance..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.