{"id":"CVE-2026-80303","kind":"vulnerability","aliases":["CVE-2026-80303"],"related":[],"title":"Avast Windows WFP stream parser: integer underflow crashes Windows","description":"An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causing a system crash.\n\n\n\nThe WFP callout driver processes network stream data and computes length values for packet fragment reassembly. The length calculation does not properly validate input stream sizes against expected boundaries. When processing specially crafted input, the length computation underflows, resulting in allocation or buffer access with an extremely large wrapped-around size value.\n\n\n\nThe underflow can be triggered remotely via network traffic destined for the filtered port, or locally via crafted data provided to the filtering interface. The resulting memory allocation failure or out-of-bounds access causes a kernel panic and system crash.","summary":"An integer underflow in the Avast Windows Filtering Platform stream parser lets crafted network traffic or local input wrap a length value. The result is a kernel panic that crashes the Windows machine.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avast","kernel-driver","other","windows"],"not_affected_if":["no-avast-installed"],"how_to_check":"- Check whether Avast's Windows Filtering Platform callout driver is installed on the machine\n- Confirm the installed Avast product version against the vendor's advisory, which the sources do not name","fix":null,"status":"open","published_at":"2026-11-06T16:18:59+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","triaged_at":"2026-11-06T16:44:55+00:00","updated_at":"2026-11-06T16:44:55+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T16:44:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Avast Windows WFP stream parser: integer underflow crashes Windows","impact":"low","summary":"An integer underflow in the Avast Windows Filtering Platform stream parser lets crafted network traffic or local input wrap a length value. The result is a kernel panic that crashes the Windows machine.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","avast","kernel-driver"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"kernel panic crashes the Windows system, causing denial of service","analyst_note":"Find the Avast advisory and the affected and fixed product versions; the NVD entry alone gives none.","how_to_check":"- Check whether Avast's Windows Filtering Platform callout driver is installed on the machine\n- Confirm the installed Avast product version against the vendor's advisory, which the sources do not name\n- unknown otherwise","plain_action":"","needs_analyst":true,"not_affected_if":["no-avast-installed"],"who_is_affected":"Windows machines running Avast security software with its Windows Filtering Platform callout driver are the ones described as exposed. Network traffic to filtered ports can trigger it remotely, and local crafted input can trigger it too. Systems without the Avast driver are not described as affected. The sources do not give affected versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000695,"input_tokens":4354,"output_tokens":520,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-80303':12A,15A 'access':122C,166C 'alloc':119C,159C 'allow':70C 'around':129C 'avast':1A,16B,27B,61C 'bound':165C 'boundari':107C 'buffer':121C 'calcul':97C 'callout':81C 'caus':75C,167C 'comput':88C,115C 'craft':34B,111C,149C 'crash':8A,51B,78C,173C 'cve':10A,13A 'data':86C,150C 'denial':71C 'destin':141C 'driver':19B,82C 'expect':106C 'extrem':125C 'failur':160C 'filter':29B,63C,144C,154C 'fragment':93C 'input':39B,102C,112C 'integ':6A,23B,56C 'interfac':155C 'kernel':18B,48B,169C 'kernel-driv':17B 'larg':126C 'length':42B,89C,96C,114C 'let':33B 'local':38B,147C 'machin':54B 'memori':158C 'network':35B,84C,139C 'out-of-bound':162C 'packet':92C 'panic':49B,170C 'parser':5A,32B,67C 'platform':30B,64C 'port':145C 'process':83C,109C 'proper':100C 'provid':151C 'reassembl':94C 'remot':137C 'result':45B,117C,157C 'servic':73C 'size':104C,130C 'special':110C 'stream':4A,31B,66C,85C,103C 'system':77C,172C 'traffic':36B,140C 'trigger':136C 'underflow':7A,24B,57C,116C,133C 'valid':101C 'valu':43B,90C,131C 'via':138C,148C 'vulner':58C 'wfp':3A,65C,80C 'window':2A,9A,21B,28B,53B,62C,69C 'wrap':40B,128C 'wrapped-around':127C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running Avast security software with its Windows Filtering Platform callout driver are the ones described as exposed. Network traffic to filtered ports can trigger it remotely, and local crafted input can trigger it too. Systems without the Avast driver are not described as affected. The sources do not give affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["avast","kerneldriver","other","unknown","windows"],"campaign_type":null,"search_a":"'-2026':11A,14A '-80303':12A,15A 'avast':1A 'crash':8A 'cve':10A,13A 'integ':6A 'parser':5A 'stream':4A 'underflow':7A 'wfp':3A 'window':2A,9A","search_b":"'avast':16B,27B 'craft':34B 'crash':51B 'driver':19B 'filter':29B 'input':39B 'integ':23B 'kernel':18B,48B 'kernel-driv':17B 'length':42B 'let':33B 'local':38B 'machin':54B 'network':35B 'panic':49B 'parser':32B 'platform':30B 'result':45B 'stream':31B 'traffic':36B 'underflow':24B 'valu':43B 'window':21B,28B,53B 'wrap':40B","search_c":"'access':122C,166C 'alloc':119C,159C 'allow':70C 'around':129C 'avast':61C 'bound':165C 'boundari':107C 'buffer':121C 'calcul':97C 'callout':81C 'caus':75C,167C 'comput':88C,115C 'craft':111C,149C 'crash':78C,173C 'data':86C,150C 'denial':71C 'destin':141C 'driver':82C 'expect':106C 'extrem':125C 'failur':160C 'filter':63C,144C,154C 'fragment':93C 'input':102C,112C 'integ':56C 'interfac':155C 'kernel':169C 'larg':126C 'length':89C,96C,114C 'local':147C 'memori':158C 'network':84C,139C 'out-of-bound':162C 'packet':92C 'panic':170C 'parser':67C 'platform':64C 'port':145C 'process':83C,109C 'proper':100C 'provid':151C 'reassembl':94C 'remot':137C 'result':117C,157C 'servic':73C 'size':104C,130C 'special':110C 'stream':66C,85C,103C 'system':77C,172C 'traffic':140C 'trigger':136C 'underflow':57C,116C,133C 'valid':101C 'valu':90C,131C 'via':138C,148C 'vulner':58C 'wfp':65C,80C 'window':62C,69C 'wrap':128C 'wrapped-around':127C","first_public_at":"2026-11-06T16:18:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-80303","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80303","severity":null,"published_at":"2026-11-06T16:18:59+00:00","modified_at":"2026-11-06T16:18:59+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","fetched_at":"2026-11-06T16:42:42+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}