Ioctl — PoC Archivehttps://poc.intelseclab.com/tags/ioctl/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Windows pstrip64.sys BYOVD Physical Memory Local Privilege Escalation — CVE-2026-29923https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-29923-pstrip64-driver-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-29923-pstrip64-driver-lpe/Critical severity — binary · CVE-2026-29923. Status: Weaponized. Affects: pstrip64.sys kernel driver (EnTech Taiwan PowerStrip, up to version 3.90.736). Tags: byovd, windows-kernel, lpe, physical-memory, eprocess, token-theft, driver, ioctl.binaryCriticalbyovdwindows-kernellpephysical-memoryeprocesstoken-theftdriverioctlRealtek rtl819x Jungle SDK Unauthenticated Kernel Memory R/W via Debug IOCTLs (CVE-2026-36355)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-36355-realtek-rtl819x-kernel-memory-rw/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-36355-realtek-rtl819x-kernel-memory-rw/Critical severity — network · CVE-2026-36355. Status: Weaponized. Affects: Realtek rtl819x "Jungle SDK" out-of-tree Wi-Fi driver (rtl8192cd). Tags: realtek, rtl819x, router-firmware, kernel-memory, ioctl, wifi-driver, root, cwe-782, cwe-787, cwe-200.networkCriticalrealtekrtl819xrouter-firmwarekernel-memoryioctlwifi-driverrootcwe-782cwe-787cwe-200Portwell Engineering Toolkits Driver Arbitrary Physical Memory R/W LPE (CVE-2026-3437)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3437-portwell-sys-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3437-portwell-sys-lpe/High severity — binary · CVE-2026-3437. Status: PoC. Affects: Portwell Engineering Toolkits driver, portwell.sys (v4.8.2). Tags: byovd, windows-driver, kernel, lpe, physical-memory, ioctl, privilege-escalation.binaryHighbyovdwindows-driverkernellpephysical-memoryioctlprivilege-escalationOracle VirtualBox Shared Folders Kernel Memory Exhaustion DoS (CVE-2026-21986)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-21986-virtualbox-shared-folder-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-21986-virtualbox-shared-folder-dos/Medium severity (CVSS 7.1) — binary · CVE-2026-21986. Status: PoC. Affects: Oracle VM VirtualBox — Shared Folders kernel driver (VBoxMiniRdr, Windows guest). Tags: virtualbox, denial-of-service, kernel-memory-exhaustion, ioctl, shared-folders, windows-driver, non-paged-pool.binaryMediumvirtualboxdenial-of-servicekernel-memory-exhaustionioctlshared-folderswindows-drivernon-paged-poolMiniTool pwdrvio.sys Kernel Driver Buffer Overflow — Local DoS/BSOD (CVE-2026-36980)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36980-minitool-kernel-driver-bsod-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36980-minitool-kernel-driver-bsod-dos/Medium severity — binary · CVE-2026-36980. Status: PoC. Affects: MiniTool pwdrvio.sys kernel driver. Tags: minitool, kernel-driver, ioctl, bsod, dos, pool-corruption, windows.binaryMediumminitoolkernel-driverioctlbsoddospool-corruptionwindowsLinux Kernel PPP Unprivileged User-Namespace Precondition Probe — CVE-2026-53075https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-53075-ppp-userns-probe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-53075-ppp-userns-probe/Info severity — binary · CVE-2026-53075. Status: PoC. Affects: Linux kernel, PPP (/dev/ppp) subsystem. Tags: linux-kernel, ppp, user-namespace, unshare, ioctl, privilege-check, cwe-284.binaryInfolinux-kernelpppuser-namespaceunshareioctlprivilege-checkcwe-284KillChain — Vulnerable Kernel Driver IOCTL Protected-Process Termination (CVE-2026-0828)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0828-killchain-driver-ioctl/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0828-killchain-driver-ioctl/High severity — binary · CVE-2026-0828. Status: Weaponized. Affects: ProcessMonitorDriver.sys (vulnerable third-party kernel driver). Tags: byovd, kernel-driver, ioctl, process-termination, edr-killer, windows, privilege-escalation, defender-bypass.binaryHighbyovdkernel-driverioctlprocess-terminationedr-killerwindowsprivilege-escalationdefender-bypass