C — PoC Archivehttps://poc.intelseclab.com/tags/c/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Sudo `chroot` Option Local Privilege Escalation (CVE-2025-32463)https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-32463-sudo-chroot-privesc/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-32463-sudo-chroot-privesc/Critical severity (CVSS 9.3) — binary · CVE-2025-32463. Status: Weaponized. Affects: sudo (-R / --chroot option). Tags: sudo, chroot, privilege-escalation, nsswitch, nss-module, local-privesc, linux, shell, c.binaryCriticalsudochrootprivilege-escalationnsswitchnss-modulelocal-privesclinuxshellcIngressNightmare: Kubernetes ingress-nginx Admission Controller Shared-Library Injection RCE (CVE-2025-1974)https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-1974-ingressnightmare-nginx-admission-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-1974-ingressnightmare-nginx-admission-rce/Critical severity (CVSS 9.8) — cloud · CVE-2025-1974. Status: Weaponized. Affects: Kubernetes ingress-nginx admission controller. Tags: kubernetes, ingress-nginx, ingressnightmare, admission-controller, nginx, ssl-engine, shared-library-injection, cluster-secrets, docker, python, c, cwe-94.cloudCriticalkubernetesingress-nginxingressnightmareadmission-controllernginxssl-engineshared-library-injectioncluster-secretsdockerpythonccwe-94FreeBSD OSS /dev/dsp Stale Kernel-Stack Buffer Local Privilege Escalation (CVE-2026-49417)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49417-freebsd-dsp-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49417-freebsd-dsp-kernel-lpe/High severity — binary · CVE-2026-49417. Status: PoC. Affects: FreeBSD kernel — OSS audio driver (/dev/dsp) buffer allocation / thread-stack recycling. Tags: freebsd, kernel, oss, dev-dsp, kernel-stack-leak, rop, smep-bypass, cr4, local-privilege-escalation, c.binaryHighfreebsdkernelossdev-dspkernel-stack-leakropsmep-bypasscr4local-privilege-escalationcFreeBSD Linuxulator AT_SECURE=0 Local Privilege Escalation via LD_PRELOAD (CVE-2026-49413)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49413-freebsd-linuxulator-atsecure-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49413-freebsd-linuxulator-atsecure-lpe/High severity — binary · CVE-2026-49413. Status: PoC. Affects: FreeBSD Linux compatibility layer ("Linuxulator", linux/linux64 kernel module) executing Linux setuid-root binaries under /compat/linux/. Tags: freebsd, linuxulator, at_secure, ld_preload, setuid, local-privilege-escalation, c.binaryHighfreebsdlinuxulatorat_secureld_preloadsetuidlocal-privilege-escalationcLinux Kernel act_pedit Partial COW Page-Cache LPE (CVE-2026-46331)https://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-46331-linux-act-pedit-lpe/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-46331-linux-act-pedit-lpe/High severity (CVSS 7.8) — binary · CVE-2026-46331. Status: PoC. Affects: Linux Kernel — net/sched/act_pedit (traffic control packet editing). Tags: LPE, Linux kernel, COW, page-cache, act_pedit, tc, netlink, traffic-control, privilege-escalation, userns, C, DirtyFrag.binaryHighLPELinux kernelCOWpage-cacheact_pedittcnetlinktraffic-controlprivilege-escalationusernsCDirtyFraglibssh2 SSH Packet Length OOB Heap Write / Unauthenticated RCE (CVE-2026-55200)https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-55200-libssh2-oob-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-55200-libssh2-oob-rce/Critical severity (CVSS 9.8) — network · CVE-2026-55200. Status: PoC. Affects: libssh2 (SSH client library). Tags: RCE, OOB-write, heap-corruption, libssh2, SSH, integer-overflow, unauthenticated, C, network.networkCriticalRCEOOB-writeheap-corruptionlibssh2SSHinteger-overflowunauthenticatedCnetworklibcurl mTLS Connection Reuse Authentication Bypass (CVE-2026-8932)https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-8932-libcurl-mtls-auth-bypass/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-8932-libcurl-mtls-auth-bypass/Low severity — network · CVE-2026-8932. Status: PoC. Affects: libcurl (embedded library; standalone curl CLI unaffected). Tags: authentication-bypass, mTLS, TLS, libcurl, connection-reuse, client-certificate, C, Low.networkLowauthentication-bypassmTLSTLSlibcurlconnection-reuseclient-certificateCLowDirtyClone — Linux Kernel LPE via Cloned Packet Page-Cache Overwrite (CVE-2026-43503)https://poc.intelseclab.com/pocs/binary/2026-06-28_dirtyclone-cve-2026-43503-lpe/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-28_dirtyclone-cve-2026-43503-lpe/High severity (CVSS 8.8) — binary · CVE-2026-43503. Status: Weaponized. Affects: Linux kernel (netfilter TEE / __pskb_copy_fclone()). Tags: LPE, Linux kernel, netfilter, TEE, IPsec, XFRM, page-cache, file-backed memory, DirtyFrag, skb, privilege escalation, C, in-the-wild.binaryHighLPELinux kernelnetfilterTEEIPsecXFRMpage-cachefile-backed memoryDirtyFragskbprivilege escalationCin-the-wild