Source: https://code.google.com/p/google-security-research/issues/detail?id=528 The attached testcase was found by fuzzing packed PE files, I suspect it was packed using "Yoda's protector". This vulnerability is obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM on all systems using Kaspersky Antivirus. (bb8.ff0): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=b5118b71 ebx=0000f8f0 ecx=0515f124 edx=b5118b71 esi=0bfe0e38 edi=0bfe005c eip=71db9229 esp=0515f0f0 ebp=0515f0f4 iopl=0 nv up ei pl nz na po nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202 kavbase_kdl!KLAV_Engine_Create+0x78227: 71db9229 8b4230 mov eax,dword ptr [edx+30h] ds:002b:b5118ba1=???????? What does it do with that value once it's loaded? 0:029> u kavbase_kdl!KLAV_Engine_Create+0x78227: 71db9229 8b4230 mov eax,dword ptr [edx+30h] <-- dereference bad pointer 71db922c 57 push edi 71db922d 8b38 mov edi,dword ptr [eax] <-- dereference again 71db922f 51 push ecx 71db9230 8b0a mov ecx,dword ptr [edx] 71db9232 8b5730 mov edx,dword ptr [edi+30h] <-- dererence again 71db9235 56 push esi 71db9236 51 push ecx 0:029> u kavbase_kdl!KLAV_Engine_Create+0x78235: 71db9237 50 push eax 71db9238 ffd2 call edx <-- attacker gets control of execution and parameters 71db923a 83c410 add esp,10h 71db923d 5f pop edi 71db923e 5e pop esi 71db923f 5d pop ebp 71db9240 c3 ret Where does that pointer come from? 3C 03 6C 9E 8C 7D A5 C5 F9 22 6E F9 71 8B 11 B5 <--- * B0 4D 5B 5C A8 19 09 FE 36 1A B6 92 3A 92 96 78 95 BD 55 64 76 C5 87 7C 00 C4 C7 36 6E 24 87 9F 5F 12 AB 96 75 ED 11 CC D1 B1 0C 4C B8 88 9A 5D 07 A5 C0 C7 5E 19 04 44 FC 4C 0F 69 20 2E 70 7A Directly from the input file, so this is obviously exploitable for remote code execution as NT AUTHORITY\SYSTEM. Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38288.zip