Double-Free — PoC Archivehttps://poc.intelseclab.com/tags/double-free/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000ITScape — KVM/arm64 vGIC-ITS Guest-to-Host VM Escape (CVE-2026-46316)https://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-46316-itscape-kvm-arm64-vgic-its-escape/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-46316-itscape-kvm-arm64-vgic-its-escape/Critical severity (CVSS 9.3) — binary · CVE-2026-46316 (GHSA-qcxh-2cm7-9fcc). Status: Weaponized. Affects: Linux kernel, KVM/arm64 in-kernel vGIC-ITS (Interrupt Translation Service) emulation (arch/arm64/kvm/vgic/vgic-its.c). Tags: linux-kernel, kvm, arm64, vgic-its, guest-to-host-escape, vm-escape, double-free, use-after-free, kaslr-bypass, heap-grooming, virtualization.binaryCriticallinux-kernelkvmarm64vgic-itsguest-to-host-escapevm-escapedouble-freeuse-after-freekaslr-bypassheap-groomingvirtualizationWindows ikeext.dll IKEv2 Double-Free Remote Kernel Exploit — CVE-2026-33824https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-33824-ikev2-ikeext-double-free-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-33824-ikev2-ikeext-double-free-rce/Critical severity — network · CVE-2026-33824. Status: Weaponized. Affects: Windows IKEv2 IPsec driver (ikeext.dll). Tags: ikev2, windows-kernel, double-free, ikeext, rop-chain, heap-grooming, reverse-shell, anti-debug, packet-fragmentation.networkCriticalikev2windows-kerneldouble-freeikeextrop-chainheap-groomingreverse-shellanti-debugpacket-fragmentationPinTheft: RDS zcopy Refcount-Steal Double-Free LPE — Pure NASM Rewrite (CVE-2026-43494)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43494-pintheft-nasm-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43494-pintheft-nasm-kernel-lpe/High severity — binary · CVE-2026-43494. Status: PoC. Affects: Linux kernel (RDS zerocopy send path + io_uring fixed buffers). Tags: linux-kernel, lpe, double-free, use-after-free, rds, io_uring, page-cache-overwrite, x86_64, nasm, asm, local, root-shell.binaryHighlinux-kernellpedouble-freeuse-after-freerdsio_uringpage-cache-overwritex86_64nasmasmlocalroot-shellPinTheft: RDS Double-Free → LPEhttps://poc.intelseclab.com/pocs/binary/2026-05-20_pintheft-rds-double-free/Wed, 20 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-20_pintheft-rds-double-free/High severity — binary. Status: Weaponized. Affects: Linux kernel (RDS subsystem + io_uring). Tags: LPE, double-free, use-after-free, Linux kernel, RDS, io_uring, page-cache-overwrite, x86_64, local.binaryHighLPEdouble-freeuse-after-freeLinux kernelRDSio_uringpage-cache-overwritex86_64localWindows Kernel Elevation of Privilege - Race Condition / Double-Free (CVE-2025-62215)https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-kernel-eop-cve-2025-62215/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-kernel-eop-cve-2025-62215/High severity (CVSS 7) — binary · CVE-2025-62215. Status: Weaponized. Affects: Windows Kernel (ntoskrnl.exe / kernel resource synchronization). Tags: EoP, Windows kernel, race condition, double-free, heap corruption, 0day, SYSTEM, Windows 10, Windows 11.binaryHighEoPWindows kernelrace conditiondouble-freeheap corruption0daySYSTEMWindows 10Windows 11Apache httpd mod_http2 Double-Free Pre-Auth RCE - CVE-2026-23918https://poc.intelseclab.com/pocs/web/2026-05-17_apache-httpd-mod-http2-double-free/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_apache-httpd-mod-http2-double-free/Critical severity — web · CVE-2026-23918. Status: Weaponized. Affects: Apache HTTP Server (httpd) with mod_http2. Tags: RCE, pre-auth, unauthenticated, double-free, heap-corruption, Apache, httpd, mod_http2, HTTP/2, TLS.webCriticalRCEpre-authunauthenticateddouble-freeheap-corruptionApachehttpdmod_http2HTTP/2TLS