tag
Local-Privilege-Escalation
Windows Server 2025 Local NTLM Reflection LPE via SMB Arbitrary Port + PetitPotam (CVE-2026-24294)
Windows 11 24H2 / Server 2025 introduced an SMB client capability allowing connections to arbitrary TCP ports via net use \\host\share /tcpport:PORT. Combined with SMB2 session multiplexing, this enables a local NTLM reflection attack: a low-privileged local…
snapd snap-confine / systemd-tmpfiles Race Condition LPE (CVE-2026-3888)
snap-confine's writable-mimic setup performs a directory swap while constructing a snap's mount namespace, and races with systemd-tmpfiles during this window. A local attacker can exploit this race to poison the namespace being constructed for a privileged…
FreeBSD OSS /dev/dsp Stale Kernel-Stack Buffer Local Privilege Escalation (CVE-2026-49417)
exp.c is a local FreeBSD kernel privilege-escalation exploit built around /dev/dsp (the OSS sound driver). It sprays hundreds of pthreads that call nanosleep() with distinctively tagged tvnsec values so their kernel stacks/return addresses are recognizable,…
FreeBSD Linuxulator AT_SECURE=0 Local Privilege Escalation via LD_PRELOAD (CVE-2026-49413)
exploit.c is a local privilege-escalation PoC targeting FreeBSD's Linux compatibility subsystem. It detects whether the Linuxulator is loaded and glibc's dynamic linker is present under /compat/linux/, locates a setuid-root Linux binary within that tree, and…
Fortinet FortiClientLinux VPN Config Symlink/Shared-Object Loading LPE — CVE-2026-24018
FortiClientLinux allows a VPN connection profile to reference a custom pre/post-connect shared object (.so) file path that gets loaded by a component of the client running with elevated privileges. Because the path is followed without validating…
ASUS DriverHub Update TOCTOU Local Privilege Escalation — CVE-2026-1880
ASUS DriverHub updates drivers by downloading a package, extracting it to C:\ProgramData\ASUS\AsusDriverHub\SupportTemp\<drivername>, and later launching setup.exe from that directory via ShellExecuteExW. Because the driver folder name can be predicted from…
Apache HTTP Server mod_rewrite/mod_setenvif/mod_proxy_fcgi ap_expr Local File Read — CVE-2026-24072
Apache HTTP Server's apexpr expression evaluation engine exposes filesystem-introspection functions (file(), filesize(), and tests like -f, -d, -e, -s, -L, -h, -x) that are meant to be restricted when expressions are parsed from a .htaccess file rather than…
System Informer phsvc Trusted-Host Confused Deputy LPE
System Informer's privileged helper process phsvc exposes an ALPC API port (\BaseNamedObjects\SiSvcApiPort) with a connect ACL open to Everyone, and authorizes connecting clients purely by checking whether the client's process image is generically…
LiteSpeed User-End cPanel Plugin Local Privilege Escalation (CVE-2026-48172)
CVE-2026-48172 is a local privilege-escalation flaw in LiteSpeed cPanel Plugin v6.5.0 and earlier. The plugin installation flow does not sufficiently validate package ownership/permissions and can be abused with symlinked install targets. A normal cPanel user…