CWE-59 — PoC Archivehttps://poc.intelseclab.com/tags/cwe-59/Latest proof-of-concept entries.Hugoen-usSat, 15 Aug 2026 00:00:00 +0000Docker — CopyEscape: Container-to-Host Escape via docker cp Race Condition (CVE-2026-17106)https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-17106-copyescape-docker-cp-host-takeover/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-17106-copyescape-docker-cp-host-takeover/Critical severity (CVSS 9.8) — binary · CVE-2026-17106. Status: Patched. Affects: Docker Engine / Docker Desktop, docker cp CLI command. Tags: docker, container-escape, race-condition, symlink, path-traversal, runc, host-takeover, linux, macos, CWE-367, CWE-59, CVE-2026-17106.binaryCriticaldockercontainer-escaperace-conditionsymlinkpath-traversalrunchost-takeoverlinuxmacosCWE-367CWE-59CVE-2026-17106Windows Defender — ShieldBreak: RoguePlanet (CVE-2026-50656) Patch Bypass via Cloud Files Rehydration + Object Manager Symlinkshttps://poc.intelseclab.com/pocs/binary/2026-08-11_shieldbreak-defender-rogueplanet-patch-bypass/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-11_shieldbreak-defender-rogueplanet-patch-bypass/High severity (CVSS 7.8) — binary · Bypass of CVE-2026-50656 (RoguePlanet); no CVE assigned to ShieldBreak as of 2026-08-11. Status: Unpatched. Affects: Microsoft Windows Defender (Antimalware Service Executable / MsMpEng.exe), threat remediation subsystem. Tags: windows, windows-defender, lpe, privilege-escalation, 0day, patch-bypass, cloud-files, cfapi, object-manager, symlink, wer, dll-sideload, CWE-59, CWE-426, microsoft, rogueplanet, shieldbreak.binaryHighwindowswindows-defenderlpeprivilege-escalation0daypatch-bypasscloud-filescfapiobject-managersymlinkwerdll-sideloadCWE-59CWE-426microsoftrogueplanetshieldbreakMicrosoft Defender Link Following Local Privilege Escalation (CVE-2026-41091)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41091-defender-link-following-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41091-defender-link-following-lpe/High severity (CVSS 7.8) — binary · CVE-2026-41091. Status: Weaponized. Affects: Microsoft Defender / Microsoft Malware Protection Engine. Tags: windows, microsoft-defender, link-following, cwe-59, cloud-files-api, ntfs-junction, oplock, privilege-escalation, lpe.binaryHighwindowsmicrosoft-defenderlink-followingcwe-59cloud-files-apintfs-junctionoplockprivilege-escalationlpeCVE-2026-50656 RoguePlanet — Safe Vulnerability Checker (Resurface)https://poc.intelseclab.com/pocs/binary/2026-06-26_cve-2026-50656-rogueplanet-checker/Fri, 26 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-26_cve-2026-50656-rogueplanet-checker/High severity (CVSS 7.8) — binary · CVE-2026-50656. Status: Researched. Affects: Microsoft Malware Protection Engine (mpengine.dll, MsMpEng.exe). Tags: LPE, Windows Defender, TOCTOU, symlink, reparse-point, junction, CWE-59, checker, detection, non-destructive, MsMpEng.binaryHighLPEWindows DefenderTOCTOUsymlinkreparse-pointjunctionCWE-59checkerdetectionnon-destructiveMsMpEng