Local-User — PoC Archivehttps://poc.intelseclab.com/tags/local-user/Latest proof-of-concept entries.Hugoen-usFri, 15 May 2026 00:00:00 +0000MiniPlasma - Windows Cloud Files Mini Filter Driver LPE (CVE-2020-17103)https://poc.intelseclab.com/pocs/binary/2026-05-15_miniplasma-cve-2020-17103/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_miniplasma-cve-2020-17103/High severity (CVSS 7.8) — binary · CVE-2020-17103. Status: Weaponized. Affects: Windows Cloud Files Mini Filter Driver (cldflt.sys) / cldapi.dll. Tags: LPE, Windows, cldflt.sys, Cloud Files API, registry-symlink, race-condition, WER-hijack, SYSTEM-shell, local-user.binaryHighLPEWindowscldflt.sysCloud Files APIregistry-symlinkrace-conditionWER-hijackSYSTEM-shelllocal-userCVE-2024-21338 — Local Privilege Escalation from Admin to Kernelhttps://poc.intelseclab.com/pocs/binary/2026-05-15_cve-2024-21338-admin-to-kernel/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_cve-2024-21338-admin-to-kernel/High severity (CVSS 7.8) — binary · CVE-2024-21338. Status: Weaponized. Affects: Microsoft Windows AppLocker driver path (\\Device\\AppID). Tags: LPE, Windows, AppLocker, token-impersonation, HVCI, admin-to-kernel, local-user.binaryHighLPEWindowsAppLockertoken-impersonationHVCIadmin-to-kernellocal-userBlueHammer Defender Local Privilege Escalation (CVE-2026-33825)https://poc.intelseclab.com/pocs/binary/2026-05-15_bluehammer-defender-lpe/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_bluehammer-defender-lpe/High severity (CVSS 7.8) — binary · CVE-2026-33825. Status: Weaponized. Affects: Microsoft Defender Antivirus update/scan workflow on Windows. Tags: LPE, Windows Defender, VSS, SAM-hive-leak, RPC, local-user.binaryHighLPEWindows DefenderVSSSAM-hive-leakRPClocal-user