https://poc.intelseclab.com/pocs/binary/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-21508-windows-mediaplayer-dll-hijack-lpe/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-21508-windows-mediaplayer-dll-hijack-lpe/High severity (CVSS 7.8) — binary · CVE-2026-21508. Status: Patched. Affects: Microsoft Windows Media Player / WUDFHost.exe. Tags: windows, dll-hijack, lpe, privilege-escalation, media-player, wudfhost, session0, com-hijack, CVE-2026-21508.binaryHighwindowsdll-hijacklpeprivilege-escalationmedia-playerwudfhostsession0com-hijackCVE-2026-21508https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-68398-ubuntu-pppol2tp-uaf-lpe/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-68398-ubuntu-pppol2tp-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2026-68398. Status: Patched. Affects: Linux Kernel (PPPoL2TP subsystem). Tags: linux, kernel, ubuntu, pppol2tp, l2tp, ppp, uaf, use-after-free, race-condition, lpe, privilege-escalation, kaslr-bypass, apparmor-bypass, suid, heap-spray, kmalloc-256, CVE-2026-68398.binaryHighlinuxkernelubuntupppol2tpl2tppppuafuse-after-freerace-conditionlpeprivilege-escalationkaslr-bypassapparmor-bypasssuidheap-spraykmalloc-256CVE-2026-68398https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-23111-nftables-catchall-uaf-lpe/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-23111-nftables-catchall-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2026-23111. Status: Patched. Affects: Linux kernel (nf_tables subsystem). Tags: linux, kernel, nftables, nf-tables, uaf, catchall, lpe, privilege-escalation, slab-spray, kaslr-bypass, rop, namespace, CVE-2026-23111.binaryHighlinuxkernelnftablesnf-tablesuafcatchalllpeprivilege-escalationslab-spraykaslr-bypassropnamespaceCVE-2026-23111https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-53361-afunix-gc-peek-uaf-container-escape/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-53361-afunix-gc-peek-uaf-container-escape/Critical severity (CVSS 9.8) — binary · CVE-2026-53361. Status: Patched. Affects: Linux Kernel (AF_UNIX socket garbage collector). Tags: linux, kernel, af-unix, garbage-collector, msg-peek, uaf, container-escape, lpe, slub, dirty-pagetable, CVE-2026-53361.binaryCriticallinuxkernelaf-unixgarbage-collectormsg-peekuafcontainer-escapelpeslubdirty-pagetableCVE-2026-53361https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-2764-firefox-jit-uaf/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-2764-firefox-jit-uaf/High severity (CVSS 8.8) — binary · CVE-2026-2764 / MFSA 2026-13. Status: Patched. Affects: Mozilla Firefox (SpiderMonkey JavaScript Engine). Tags: firefox, spidermonkey, jit, uaf, type-confusion, wasm, browser, ionmonkey, baseline, proxy, CVE-2026-2764.binaryHighfirefoxspidermonkeyjituaftype-confusionwasmbrowserionmonkeybaselineproxyCVE-2026-2764https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-64564-sctphantom-sctp-asconf-uaf-lpe/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-64564-sctphantom-sctp-asconf-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2026-64564. Status: Patched. Affects: Linux kernel, SCTP (Stream Control Transmission Protocol) ASCONF subsystem. Tags: linux, kernel, lpe, sctp, use-after-free, asconf, del-ip, heap-spray, packet-tx-ring, kaslr-bypass, credential-overwrite, debian, CWE-416, CVE-2026-64564.binaryHighlinuxkernellpesctpuse-after-freeasconfdel-ipheap-spraypacket-tx-ringkaslr-bypasscredential-overwritedebianCWE-416CVE-2026-64564https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-68138-linux-qdisc-ratetable-race-lpe/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-68138-linux-qdisc-ratetable-race-lpe/High severity (CVSS 7.8) — binary · CVE-2026-68138. Status: Patched. Affects: Linux kernel, traffic-control qdisc rate-table subsystem (qdisc_get_rtab / qdisc_put_rtab). Tags: linux, kernel, lpe, race-condition, use-after-free, qdisc, traffic-control, flower, bpf, pipe, page-cache, modprobe, CWE-362, CWE-416, CVE-2026-68138.binaryHighlinuxkernellperace-conditionuse-after-freeqdisctraffic-controlflowerbpfpipepage-cachemodprobeCWE-362CWE-416CVE-2026-68138https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-64531-ovswrap-linux-ovs-lpe/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-64531-ovswrap-linux-ovs-lpe/High severity (CVSS 7.8) — binary · CVE-2026-64531. Status: Patched. Affects: Linux kernel, Open vSwitch (OVS) kernel module, conntrack subsystem. Tags: linux, kernel, lpe, openvswitch, ovs, conntrack, netlink, memory-corruption, sudoers, CVE-2026-64531.binaryHighlinuxkernellpeopenvswitchovsconntracknetlinkmemory-corruptionsudoersCVE-2026-64531https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-17106-copyescape-docker-cp-host-takeover/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-17106-copyescape-docker-cp-host-takeover/Critical severity (CVSS 9.8) — binary · CVE-2026-17106. Status: Patched. Affects: Docker Engine / Docker Desktop, docker cp CLI command. Tags: docker, container-escape, race-condition, symlink, path-traversal, runc, host-takeover, linux, macos, CWE-367, CWE-59, CVE-2026-17106.binaryCriticaldockercontainer-escaperace-conditionsymlinkpath-traversalrunchost-takeoverlinuxmacosCWE-367CWE-59CVE-2026-17106https://poc.intelseclab.com/pocs/binary/2026-08-11_shieldbreak-defender-rogueplanet-patch-bypass/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-11_shieldbreak-defender-rogueplanet-patch-bypass/High severity (CVSS 7.8) — binary · Bypass of CVE-2026-50656 (RoguePlanet); no CVE assigned to ShieldBreak as of 2026-08-11. Status: Unpatched. Affects: Microsoft Windows Defender (Antimalware Service Executable / MsMpEng.exe), threat remediation subsystem. Tags: windows, windows-defender, lpe, privilege-escalation, 0day, patch-bypass, cloud-files, cfapi, object-manager, symlink, wer, dll-sideload, CWE-59, CWE-426, microsoft, rogueplanet, shieldbreak.binaryHighwindowswindows-defenderlpeprivilege-escalation0daypatch-bypasscloud-filescfapiobject-managersymlinkwerdll-sideloadCWE-59CWE-426microsoftrogueplanetshieldbreakhttps://poc.intelseclab.com/pocs/binary/2026-08-09_cve-2026-64561-zapscape-kvm-shadow-mmu-guest-to-host/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-09_cve-2026-64561-zapscape-kvm-shadow-mmu-guest-to-host/High severity (CVSS 8.8) — binary · CVE-2026-64561. Status: Patched. Affects: Linux kernel, KVM/x86 shadow-MMU (nested EPT/NPT shadowing) — arch/x86/kvm/mmu/mmu.c and arch/x86/kvm/mmu/paging_tmpl.h. Tags: linux-kernel, kvm, x86, shadow-mmu, nested-virtualization, svm, npt, ept, guest-to-host-escape, vm-escape, use-after-free, CWE-416, cross-cache, kaslr-bypass, usermode-helper, virtualization.binaryHighlinux-kernelkvmx86shadow-mmunested-virtualizationsvmnpteptguest-to-host-escapevm-escapeuse-after-freeCWE-416cross-cachekaslr-bypassusermode-helpervirtualizationhttps://poc.intelseclab.com/pocs/binary/2026-08-09_mariadb-low-priv-rce-st-area-cursor-uaf/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-09_mariadb-low-priv-rce-st-area-cursor-uaf/Critical severity (CVSS 8.8) — binary · MDEV-40328 (ST_Area OOB read); cursor-array UAF has no assigned CVE yet. Status: Unpatched. Affects: MariaDB Server, ST_Area() geometry function and SYS_REFCURSOR cursor-array management. Tags: mariadb, database, rce, low-privilege, heap, oob-read, use-after-free, aslr-bypass, pie-bypass, coop, vtable, cursor, st-area, multipolygon, CWE-125, CWE-416, docker, v12-security.binaryCriticalmariadbdatabasercelow-privilegeheapoob-readuse-after-freeaslr-bypasspie-bypasscoopvtablecursorst-areamultipolygonCWE-125CWE-416dockerv12-securityhttps://poc.intelseclab.com/pocs/binary/2026-08-01_notcve-2026-0010-barrier-daemon-lpe/Sat, 01 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-01_notcve-2026-0010-barrier-daemon-lpe/High severity — binary · NotCVE-2026-0010 (disputed CVE assignment — author contests the identifier). Status: Unpatched — Barrier is unmaintained with no vendor fix; patched successor Deskflow covers the same issue via CVE-2026-41477 / GHSA-6rx5-g478-775c. Affects: Barrier (debauchee), Windows service daemon barrierd.exe. Tags: barrier, barrierd, windows, ipc, tcp-24801, unauthenticated, lpe, privilege-escalation, system, cwe-306, local.binaryHighbarrierbarrierdwindowsipctcp-24801unauthenticatedlpeprivilege-escalationsystemcwe-306localhttps://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-49176-windows-walletservice-lpe/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-49176-windows-walletservice-lpe/High severity (CVSS 7.8) — binary · CVE-2026-49176. Status: Weaponized — SYSTEM shell confirmed against a real, vulnerable Windows 11 build. Affects: Windows WalletService (Windows.ApplicationModel.Wallet WinRT API, backed by an ESE/Jet Blue database under the caller's Documents\Wallet folder). Tags: windows, walletservice, lpe, privilege-escalation, ese, extensible-storage-engine, known-folder-redirection, persisted-callback, local.binaryHighwindowswalletservicelpeprivilege-escalationeseextensible-storage-engineknown-folder-redirectionpersisted-callbacklocalhttps://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-46316-itscape-kvm-arm64-vgic-its-escape/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-46316-itscape-kvm-arm64-vgic-its-escape/Critical severity (CVSS 9.3) — binary · CVE-2026-46316 (GHSA-qcxh-2cm7-9fcc). Status: Weaponized. Affects: Linux kernel, KVM/arm64 in-kernel vGIC-ITS (Interrupt Translation Service) emulation (arch/arm64/kvm/vgic/vgic-its.c). Tags: linux-kernel, kvm, arm64, vgic-its, guest-to-host-escape, vm-escape, double-free, use-after-free, kaslr-bypass, heap-grooming, virtualization.binaryCriticallinux-kernelkvmarm64vgic-itsguest-to-host-escapevm-escapedouble-freeuse-after-freekaslr-bypassheap-groomingvirtualizationhttps://poc.intelseclab.com/pocs/binary/2026-07-27_greatxml-winre-bitlocker-bypass/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_greatxml-winre-bitlocker-bypass/High severity — binary · N/A (no CVE assigned, no Microsoft advisory as of 2026-07-27). Status: Unpatched. Affects: Windows Recovery Environment (WinRE) — Microsoft Defender Offline Scan launch path (ReAgent.xml scheduled operation). Tags: windows, bitlocker, winre, defender, offline-scan, trust-boundary-bypass, zero-day, unpatched, physical-access, local.binaryHighwindowsbitlockerwinredefenderoffline-scantrust-boundary-bypasszero-dayunpatchedphysical-accesslocalhttps://poc.intelseclab.com/pocs/binary/2026-07-19_cve-2026-14431-v8-array-iterator-maglev-type-confusion/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-19_cve-2026-14431-v8-array-iterator-maglev-type-confusion/High severity (CVSS 8.8) — binary · CVE-2026-14431. Status: PoC — real, working sandboxed read/write primitives (addrof/fakeobj); no sandbox-escape/RCE chain published (author states this is still in progress). Affects: V8 JavaScript engine (Google Chrome and other Chromium-based browsers). Tags: v8, javascript-engine, chromium, maglev, type-confusion, array-iterator, cwe-843, sandboxed-read-write, memory-corruption.binaryHighv8javascript-enginechromiummaglevtype-confusionarray-iteratorcwe-843sandboxed-read-writememory-corruptionhttps://poc.intelseclab.com/pocs/binary/2026-07-19_legacyhive-user-profile-service-hive-load-lpe/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-19_legacyhive-user-profile-service-hive-load-lpe/High severity — binary. Status: Weaponized. Affects: Microsoft Windows user profile service / registry hive loading path. Tags: windows, lpe, user-profile-service, registry-hive, usrclass.dat, oplock, symbolic-link.binaryHighwindowslpeuser-profile-serviceregistry-hiveusrclass.datoplocksymbolic-linkhttps://poc.intelseclab.com/pocs/binary/2026-07-08_cve-2026-43499-ghostlock-nebula-security/Wed, 08 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-08_cve-2026-43499-ghostlock-nebula-security/High severity (CVSS 7.8) — binary · CVE-2026-43499 (aka "GhostLock"). Status: Weaponized (per Nebula Security disclosure); no exploit code mirrored into this repo, see Notes. Affects: Linux kernel — rtmutex priority-inheritance (futex-PI) subsystem, CONFIG_FUTEX_PI. Tags: linux-kernel, use-after-free, futex, rtmutex, priority-inheritance, lpe, local, container-escape, kernelctf, ghostlock.binaryHighlinux-kerneluse-after-freefutexrtmutexpriority-inheritancelpelocalcontainer-escapekernelctfghostlockhttps://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-32463-sudo-chroot-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-32463-sudo-chroot-privesc/Critical severity (CVSS 9.3) — binary · CVE-2025-32463. Status: Weaponized. Affects: sudo (-R / --chroot option). Tags: sudo, chroot, privilege-escalation, nsswitch, nss-module, local-privesc, linux, shell, c.binaryCriticalsudochrootprivilege-escalationnsswitchnss-modulelocal-privesclinuxshellchttps://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-49844-redis-lua-uaf-jop-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-49844-redis-lua-uaf-jop-rce/Critical severity (CVSS 9.9) — binary · CVE-2025-49844. Status: Weaponized. Affects: Redis (embedded Lua scripting engine). Tags: redis, lua, use-after-free, uaf, memory-corruption, jop, jump-oriented-programming, shellcode, iced-x86, docker, cwe-416, rce.binaryCriticalredisluause-after-freeuafmemory-corruptionjopjump-oriented-programmingshellcodeiced-x86dockercwe-416rcehttps://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-54957-dolby-decoder-oob-write/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-54957-dolby-decoder-oob-write/Critical severity (CVSS 9.8) — binary · CVE-2025-54957. Status: Weaponized. Affects: Dolby Digital Plus (DDPlus) Unified Decoder — bundled in Android media stack, iOS/macOS CoreAudio-adjacent decoders, and ChromeOS. Tags: dolby, ddplus, ac-3, ec-3, audio-codec, out-of-bounds-write, integer-overflow, zero-click, android, ios, macos, heap-corruption.binaryCriticaldolbyddplusac-3ec-3audio-codecout-of-bounds-writeinteger-overflowzero-clickandroidiosmacosheap-corruptionhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20698-xnu-pf-route-heap-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20698-xnu-pf-route-heap-overflow/High severity — binary · CVE-2026-20698. Status: PoC. Affects: XNU kernel routing socket subsystem (PF_ROUTE, bsd/net/rtsock.c / bsd/net/radix.c). Tags: xnu, kernel, ios, macos, pf_route, routing-socket, heap-overflow, radix-tree, kernel-panic, bounds-safety.binaryHighxnukerneliosmacospf_routerouting-socketheap-overflowradix-treekernel-panicbounds-safetyhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3609-xigncode3-lsass-credential-dump/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3609-xigncode3-lsass-credential-dump/High severity — binary · CVE-2026-3609. Status: Weaponized. Affects: Wellbia XIGNCODE3 anti-cheat driver (xhunter1.sys). Tags: lsass, credential-dumping, anti-cheat, kernel-driver, ppl-bypass, xigncode3, windows, byovd.binaryHighlsasscredential-dumpinganti-cheatkernel-driverppl-bypassxigncode3windowsbyovdhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-32202-lnk-idcontrolw-builder/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-32202-lnk-idcontrolw-builder/High severity — binary · CVE-2026-32202 (related: CVE-2026-21510). Status: PoC. Affects: Windows Shell (shell32.dll) / Windows Explorer. Tags: lnk, shell32, windows, apt28, smb-coercion, zero-click, reverse-engineering, control-panel.binaryHighlnkshell32windowsapt28smb-coercionzero-clickreverse-engineeringcontrol-panelhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-26179-secure-kernel-vsm-poc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-26179-secure-kernel-vsm-poc/High severity — binary · CVE-2026-26179 / ZDI-26-276. Status: PoC. Affects: Windows Secure Kernel / Virtual Secure Mode (VSM), Virtual Trust Level 1 (VTL1) transfer functions (nt!VslpLockPagesForTransfer, VslpEnterIumSecureMode, nt!VslpUnlockPagesForTransfer). Tags: secure-kernel, vsm, vtl1, windows-kernel, hyper-v, mdl, memory-corruption, driver.binaryHighsecure-kernelvsmvtl1windows-kernelhyper-vmdlmemory-corruptiondriverhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-42978-wpn-uaf-race/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-42978-wpn-uaf-race/High severity (CVSS 7.8) — binary · CVE-2026-42978. Status: PoC. Affects: Windows Push Notifications service (WpnService, wpncore.dll). Tags: windows, kernel, wpnservice, use-after-free, race-condition, toctou, privilege-escalation, etw, sysmon, patch-diffing.binaryHighwindowskernelwpnserviceuse-after-freerace-conditiontoctouprivilege-escalationetwsysmonpatch-diffinghttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-29923-pstrip64-driver-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-29923-pstrip64-driver-lpe/Critical severity — binary · CVE-2026-29923. Status: Weaponized. Affects: pstrip64.sys kernel driver (EnTech Taiwan PowerStrip, up to version 3.90.736). Tags: byovd, windows-kernel, lpe, physical-memory, eprocess, token-theft, driver, ioctl.binaryCriticalbyovdwindows-kernellpephysical-memoryeprocesstoken-theftdriverioctlhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-40369-windows-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-40369-windows-kernel-lpe/High severity — binary · CVE-2026-40369. Status: PoC. Affects: Windows kernel (ntoskrnl.exe). Tags: windows, kernel, lpe, privilege-escalation, token-stealing, sedebugprivilege, ntoskrnl, local.binaryHighwindowskernellpeprivilege-escalationtoken-stealingsedebugprivilegentoskrnllocalhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49160-http-sys-http2-bomb-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49160-http-sys-http2-bomb-dos/High severity — binary · CVE-2026-49160. Status: PoC. Affects: Windows HTTP.sys kernel-mode driver (Windows 10 build 26100 confirmed in crash logs). Tags: windows, http.sys, kernel, http2, dos, bsod, memory-corruption, integer-overflow.binaryHighwindowshttp.syskernelhttp2dosbsodmemory-corruptioninteger-overflowhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20817-windows-wer-alpc-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20817-windows-wer-alpc-lpe/High severity — binary · CVE-2026-20817. Status: PoC. Affects: Windows Error Reporting Service (WerSvc). Tags: windows, wersvc, alpc, lpe, privilege-escalation, ntdll, system32, native-cpp.binaryHighwindowswersvcalpclpeprivilege-escalationntdllsystem32native-cpphttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-2636-clfs-sys-bsod/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-2636-clfs-sys-bsod/Medium severity — binary · CVE-2026-2636. Status: PoC. Affects: Windows Common Log File System driver (CLFS.sys, version 10.0.22621.5037 used as reference). Tags: clfs, windows-kernel-driver, bsod, denial-of-service, cwe-159, irp, kebugcheckex, unprivileged.binaryMediumclfswindows-kernel-driverbsoddenial-of-servicecwe-159irpkebugcheckexunprivilegedhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-35250-virtualbox-vbva-integer-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-35250-virtualbox-vbva-integer-overflow/Low severity (CVSS 2.3) — binary · CVE-2026-35250. Status: PoC. Affects: Oracle VirtualBox — DevVGA_VBVA.cpp. Tags: virtualbox, integer-overflow, dos, vbva, guest-to-host, cwe-190, ai-assisted-research.binaryLowvirtualboxinteger-overflowdosvbvaguest-to-hostcwe-190ai-assisted-researchhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-44656-vim-modeline-path-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-44656-vim-modeline-path-command-injection/High severity — binary · CVE-2026-44656. Status: PoC. Affects: Vim. Tags: vim, modeline, command-injection, backtick-expansion, path-option, local-code-execution.binaryHighvimmodelinecommand-injectionbacktick-expansionpath-optionlocal-code-executionhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-6307-longinus-v8-exploit-kit/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-6307-longinus-v8-exploit-kit/Critical severity — binary · CVE-2026-6307. Status: Weaponized. Affects: V8 JavaScript engine (Chromium-based browsers). Tags: v8, javascript-engine, browser-exploit, memory-corruption, yara, exploit-kit.binaryCriticalv8javascript-enginebrowser-exploitmemory-corruptionyaraexploit-kithttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3888-snapd-confine-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3888-snapd-confine-lpe/High severity — binary · CVE-2026-3888. Status: Weaponized. Affects: snapd (snap-confine writable-mimic / systemd-tmpfiles handling). Tags: snapd, snap-confine, linux, local-privilege-escalation, race-condition, systemd-tmpfiles, mount-namespace.binaryHighsnapdsnap-confinelinuxlocal-privilege-escalationrace-conditionsystemd-tmpfilesmount-namespacehttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-21018-samsung-sveservice-oob-write-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-21018-samsung-sveservice-oob-write-lpe/High severity — binary · CVE-2026-21018 (Samsung SVE-2026-0478, SMR May 2026). Status: PoC. Affects: Samsung SveService (com.sec.sve) system service and its libsvejni.so native library. Tags: android, samsung, binder, native, out-of-bounds-write, jni, lpe, memcpy, memset.binaryHighandroidsamsungbindernativeout-of-bounds-writejnilpememcpymemsethttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20980-samsung-android-at-command-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20980-samsung-android-at-command-lpe/Critical severity — binary · CVE-2026-20980 (chained with CVE-2026-20981 and CVE-2026-20982). Status: PoC. Affects: Samsung Android AT-command distribution stack (at_distributor / libpacm_client.so, FacAtFunction system app, ShortcutService). Tags: android, samsung, at-command, privilege-escalation, usb, system-server, exploit-chain, java, apk.binaryCriticalandroidsamsungat-commandprivilege-escalationusbsystem-serverexploit-chainjavaapkhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-27831-rldns-heap-oob-read-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-27831-rldns-heap-oob-read-dos/Medium severity — binary · CVE-2026-27831. Status: PoC. Affects: rldns 1.3 (open-source DNS server). Tags: dns, heap-overflow, out-of-bounds-read, denial-of-service, rldns, memory-corruption, x86_64.binaryMediumdnsheap-overflowout-of-bounds-readdenial-of-servicerldnsmemory-corruptionx86_64https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-2005-postgresql-pgcrypto-heapoverflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-2005-postgresql-pgcrypto-heapoverflow/Critical severity — binary · CVE-2026-2005. Status: PoC. Affects: PostgreSQL pgcrypto extension (PGP session-key parsing). Tags: postgresql, pgcrypto, heap-overflow, aslr-bypass, privilege-escalation, pgp, memory-corruption.binaryCriticalpostgresqlpgcryptoheap-overflowaslr-bypassprivilege-escalationpgpmemory-corruptionhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3437-portwell-sys-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3437-portwell-sys-lpe/High severity — binary · CVE-2026-3437. Status: PoC. Affects: Portwell Engineering Toolkits driver, portwell.sys (v4.8.2). Tags: byovd, windows-driver, kernel, lpe, physical-memory, ioctl, privilege-escalation.binaryHighbyovdwindows-driverkernellpephysical-memoryioctlprivilege-escalationhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43494-pintheft-nasm-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43494-pintheft-nasm-kernel-lpe/High severity — binary · CVE-2026-43494. Status: PoC. Affects: Linux kernel (RDS zerocopy send path + io_uring fixed buffers). Tags: linux-kernel, lpe, double-free, use-after-free, rds, io_uring, page-cache-overwrite, x86_64, nasm, asm, local, root-shell.binaryHighlinux-kernellpedouble-freeuse-after-freerdsio_uringpage-cache-overwritex86_64nasmasmlocalroot-shellhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-14459-pardus-software-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-14459-pardus-software-lpe/High severity (CVSS 8.8) — binary · CVE-2026-14459 (also covers CVE-2026-14460). Status: Weaponized. Affects: pardus-software (Pardus Software Center). Tags: linux, pardus, privilege-escalation, polkit, pkexec, apt-injection, argument-injection, local-dos.binaryHighlinuxpardusprivilege-escalationpolkitpkexecapt-injectionargument-injectionlocal-doshttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41651-packagekit-toctou-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41651-packagekit-toctou-lpe/High severity — binary · CVE-2026-41651. Status: PoC. Affects: PackageKit daemon (packagekitd). Tags: linux, packagekit, toctou, race-condition, lpe, polkit, privilege-escalation, dbus.binaryHighlinuxpackagekittoctourace-conditionlpepolkitprivilege-escalationdbushttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-21986-virtualbox-shared-folder-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-21986-virtualbox-shared-folder-dos/Medium severity (CVSS 7.1) — binary · CVE-2026-21986. Status: PoC. Affects: Oracle VM VirtualBox — Shared Folders kernel driver (VBoxMiniRdr, Windows guest). Tags: virtualbox, denial-of-service, kernel-memory-exhaustion, ioctl, shared-folders, windows-driver, non-paged-pool.binaryMediumvirtualboxdenial-of-servicekernel-memory-exhaustionioctlshared-folderswindows-drivernon-paged-poolhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-33317-optee-pkcs11-heap-oob-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-33317-optee-pkcs11-heap-oob-write/High severity (CVSS 8.7) — binary · CVE-2026-33317 (GHSA-8cqw-mg7v-c9p9). Status: PoC. Affects: OP-TEE OS — PKCS#11 Trusted Application (optee_os, ta/pkcs11). Tags: optee, trustzone, pkcs11, secure-world, heap-corruption, oob-write, qemu, trusted-application.binaryHighopteetrustzonepkcs11secure-worldheap-corruptionoob-writeqemutrusted-applicationhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3008-notepadpp-formatstring/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3008-notepadpp-formatstring/Medium severity — binary · CVE-2026-3008. Status: PoC. Affects: Notepad++ 8.9.3. Tags: notepad++, format-string, wsprintfw, dos, information-disclosure, localization, windows.binaryMediumnotepad++format-stringwsprintfwdosinformation-disclosurelocalizationwindowshttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-1668-mips-switch-kernel-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-1668-mips-switch-kernel-rce/Critical severity — binary · CVE-2026-1668. Status: Weaponized. Affects: MIPS-based managed switch firmware (web management HTTP server), e.g. SG2005P/SG2008/SG2016P/SG2210MP/SG2218/SG2428/SG3210/SL2428/TL-SG2428 series firmware built around 2025-10-31. Tags: mips, embedded-linux, kernel-exploit, firmware, managed-switch, reverse-shell, pre-auth, shellcode.binaryCriticalmipsembedded-linuxkernel-exploitfirmwaremanaged-switchreverse-shellpre-authshellcodehttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36981-minitool-kernel-driver-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36981-minitool-kernel-driver-lpe/High severity — binary · CVE-2026-36981. Status: PoC. Affects: MiniTool pwdrvio.sys kernel driver. Tags: minitool, kernel-driver, write-what-where, lpe, arbitrary-kernel-write, windows.binaryHighminitoolkernel-driverwrite-what-wherelpearbitrary-kernel-writewindowshttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36980-minitool-kernel-driver-bsod-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36980-minitool-kernel-driver-bsod-dos/Medium severity — binary · CVE-2026-36980. Status: PoC. Affects: MiniTool pwdrvio.sys kernel driver. Tags: minitool, kernel-driver, ioctl, bsod, dos, pool-corruption, windows.binaryMediumminitoolkernel-driverioctlbsoddospool-corruptionwindows