Heap-Corruption — PoC Archivehttps://poc.intelseclab.com/tags/heap-corruption/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Dolby Unified (DDPlus) Decoder Out-of-Bounds Write via Evolution Data (CVE-2025-54957)https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-54957-dolby-decoder-oob-write/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-54957-dolby-decoder-oob-write/Critical severity (CVSS 9.8) — binary · CVE-2025-54957. Status: Weaponized. Affects: Dolby Digital Plus (DDPlus) Unified Decoder — bundled in Android media stack, iOS/macOS CoreAudio-adjacent decoders, and ChromeOS. Tags: dolby, ddplus, ac-3, ec-3, audio-codec, out-of-bounds-write, integer-overflow, zero-click, android, ios, macos, heap-corruption.binaryCriticaldolbyddplusac-3ec-3audio-codecout-of-bounds-writeinteger-overflowzero-clickandroidiosmacosheap-corruptionTasmota fetch_jpg() Integer Wraparound to Heap Corruption (CVE-2026-38427)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38427-tasmota-fetchjpg-integer-wraparound/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-38427-tasmota-fetchjpg-integer-wraparound/Critical severity (CVSS 9.8) — network · CVE-2026-38427. Status: PoC. Affects: Arendst Tasmota (ESP32 firmware). Tags: tasmota, esp32, iot, integer-overflow, heap-corruption, rce, mjpeg, scripter.networkCriticaltasmotaesp32iotinteger-overflowheap-corruptionrcemjpegscripterOP-TEE PKCS#11 TA Out-of-Bounds Heap Write via `C_GetAttributeValue` (CVE-2026-33317)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-33317-optee-pkcs11-heap-oob-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-33317-optee-pkcs11-heap-oob-write/High severity (CVSS 8.7) — binary · CVE-2026-33317 (GHSA-8cqw-mg7v-c9p9). Status: PoC. Affects: OP-TEE OS — PKCS#11 Trusted Application (optee_os, ta/pkcs11). Tags: optee, trustzone, pkcs11, secure-world, heap-corruption, oob-write, qemu, trusted-application.binaryHighopteetrustzonepkcs11secure-worldheap-corruptionoob-writeqemutrusted-applicationRedis Vector Set Duplicate HNSW Node ID RCEhttps://poc.intelseclab.com/pocs/network/2026-07-03_redis-vector-set-hnsw-id-rce/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_redis-vector-set-hnsw-id-rce/Critical severity — network · None assigned as of 2026-07-03. Status: Weaponized. Affects: Redis server, Vector Set module (modules/vector-sets). Tags: redis, vector-set, hnsw, rce, deserialization, use-after-free, heap-corruption, rdb-restore.networkCriticalredisvector-sethnswrcedeserializationuse-after-freeheap-corruptionrdb-restorec-ares TCP ares_getaddrinfo() Use-After-Free Code Executionhttps://poc.intelseclab.com/pocs/network/2026-07-03_c-ares-tcp-getaddrinfo-uaf/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_c-ares-tcp-getaddrinfo-uaf/High severity — network · None assigned as of 2026-07-03. Status: PoC. Affects: c-ares (async DNS resolver library). Tags: c-ares, use-after-free, dns, resolver, tcp, heap-corruption, code-execution, edns.networkHighc-aresuse-after-freednsresolvertcpheap-corruptioncode-executionednslibssh2 SSH Packet Length OOB Heap Write / Unauthenticated RCE (CVE-2026-55200)https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-55200-libssh2-oob-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-30_cve-2026-55200-libssh2-oob-rce/Critical severity (CVSS 9.8) — network · CVE-2026-55200. Status: PoC. Affects: libssh2 (SSH client library). Tags: RCE, OOB-write, heap-corruption, libssh2, SSH, integer-overflow, unauthenticated, C, network.networkCriticalRCEOOB-writeheap-corruptionlibssh2SSHinteger-overflowunauthenticatedCnetworkFFmpeg MagicYUV Decoder Out-of-Bounds Write / RCE — PixelSmash (CVE-2026-8461)https://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-8461-ffmpeg-magicyuv-oob-rce/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-8461-ffmpeg-magicyuv-oob-rce/High severity (CVSS 8.8) — binary · CVE-2026-8461. Status: PoC. Affects: FFmpeg libavcodec — MagicYUV video decoder. Tags: RCE, OOB-write, heap-corruption, FFmpeg, MagicYUV, media, video, PixelSmash, libavcodec, Python, High.binaryHighRCEOOB-writeheap-corruptionFFmpegMagicYUVmediavideoPixelSmashlibavcodecPythonHighWindows Kernel Elevation of Privilege - Race Condition / Double-Free (CVE-2025-62215)https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-kernel-eop-cve-2025-62215/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-kernel-eop-cve-2025-62215/High severity (CVSS 7) — binary · CVE-2025-62215. Status: Weaponized. Affects: Windows Kernel (ntoskrnl.exe / kernel resource synchronization). Tags: EoP, Windows kernel, race condition, double-free, heap corruption, 0day, SYSTEM, Windows 10, Windows 11.binaryHighEoPWindows kernelrace conditiondouble-freeheap corruption0daySYSTEMWindows 10Windows 11Apache httpd mod_http2 Double-Free Pre-Auth RCE - CVE-2026-23918https://poc.intelseclab.com/pocs/web/2026-05-17_apache-httpd-mod-http2-double-free/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_apache-httpd-mod-http2-double-free/Critical severity — web · CVE-2026-23918. Status: Weaponized. Affects: Apache HTTP Server (httpd) with mod_http2. Tags: RCE, pre-auth, unauthenticated, double-free, heap-corruption, Apache, httpd, mod_http2, HTTP/2, TLS.webCriticalRCEpre-authunauthenticateddouble-freeheap-corruptionApachehttpdmod_http2HTTP/2TLS