Byovd — PoC Archivehttps://poc.intelseclab.com/tags/byovd/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000XIGNCODE3 Anti-Cheat Driver PPL-Bypass LSASS Credential Dump (CVE-2026-3609)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3609-xigncode3-lsass-credential-dump/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3609-xigncode3-lsass-credential-dump/High severity — binary · CVE-2026-3609. Status: Weaponized. Affects: Wellbia XIGNCODE3 anti-cheat driver (xhunter1.sys). Tags: lsass, credential-dumping, anti-cheat, kernel-driver, ppl-bypass, xigncode3, windows, byovd.binaryHighlsasscredential-dumpinganti-cheatkernel-driverppl-bypassxigncode3windowsbyovdWindows pstrip64.sys BYOVD Physical Memory Local Privilege Escalation — CVE-2026-29923https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-29923-pstrip64-driver-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-29923-pstrip64-driver-lpe/Critical severity — binary · CVE-2026-29923. Status: Weaponized. Affects: pstrip64.sys kernel driver (EnTech Taiwan PowerStrip, up to version 3.90.736). Tags: byovd, windows-kernel, lpe, physical-memory, eprocess, token-theft, driver, ioctl.binaryCriticalbyovdwindows-kernellpephysical-memoryeprocesstoken-theftdriverioctlPortwell Engineering Toolkits Driver Arbitrary Physical Memory R/W LPE (CVE-2026-3437)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3437-portwell-sys-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3437-portwell-sys-lpe/High severity — binary · CVE-2026-3437. Status: PoC. Affects: Portwell Engineering Toolkits driver, portwell.sys (v4.8.2). Tags: byovd, windows-driver, kernel, lpe, physical-memory, ioctl, privilege-escalation.binaryHighbyovdwindows-driverkernellpephysical-memoryioctlprivilege-escalationKillChain — Vulnerable Kernel Driver IOCTL Protected-Process Termination (CVE-2026-0828)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0828-killchain-driver-ioctl/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0828-killchain-driver-ioctl/High severity — binary · CVE-2026-0828. Status: Weaponized. Affects: ProcessMonitorDriver.sys (vulnerable third-party kernel driver). Tags: byovd, kernel-driver, ioctl, process-termination, edr-killer, windows, privilege-escalation, defender-bypass.binaryHighbyovdkernel-driverioctlprocess-terminationedr-killerwindowsprivilege-escalationdefender-bypass