Kaspersky: Mo Unpackers, Mo Problems.
Summary: Google Project Zero researcher Tavis Ormandy reported dozens of vulnerabilities in Kaspersky Antivirus, including a stack buffer overflow in its Thinstall container unpacker that he exploited to run code as NT AUTHORITY\SYSTEM on versions 15 and 16 under Windows 7. Kaspersky resolved the Thinstall flaw in definition releases after 7-Sep-2015, and Ormandy noted the product lacked /GS stack protection and that its /DYNAMICBASE implementation was undermined by predictable PAGE_EXECUTE_READWRITE mappings.
Bottom line: Antivirus intercepts filesystem and network traffic, so Ormandy notes that merely receiving an email - without opening it - was enough to trigger exploitation, and he cites an active black market trade in antivirus exploits. The bugs spanned network intrusion detection, SSL interception, file scanning, browser integration and local privilege escalation, any of which he says could result in complete compromise of a Kaspersky user.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026