https://poc.intelseclab.com/tags/local/Latest proof-of-concept entries.Hugoen-usSat, 01 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-01_notcve-2026-0010-barrier-daemon-lpe/Sat, 01 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-01_notcve-2026-0010-barrier-daemon-lpe/High severity — binary · NotCVE-2026-0010 (disputed CVE assignment — author contests the identifier). Status: Unpatched — Barrier is unmaintained with no vendor fix; patched successor Deskflow covers the same issue via CVE-2026-41477 / GHSA-6rx5-g478-775c. Affects: Barrier (debauchee), Windows service daemon barrierd.exe. Tags: barrier, barrierd, windows, ipc, tcp-24801, unauthenticated, lpe, privilege-escalation, system, cwe-306, local.binaryHighbarrierbarrierdwindowsipctcp-24801unauthenticatedlpeprivilege-escalationsystemcwe-306localhttps://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-49176-windows-walletservice-lpe/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-49176-windows-walletservice-lpe/High severity (CVSS 7.8) — binary · CVE-2026-49176. Status: Weaponized — SYSTEM shell confirmed against a real, vulnerable Windows 11 build. Affects: Windows WalletService (Windows.ApplicationModel.Wallet WinRT API, backed by an ESE/Jet Blue database under the caller's Documents\Wallet folder). Tags: windows, walletservice, lpe, privilege-escalation, ese, extensible-storage-engine, known-folder-redirection, persisted-callback, local.binaryHighwindowswalletservicelpeprivilege-escalationeseextensible-storage-engineknown-folder-redirectionpersisted-callbacklocalhttps://poc.intelseclab.com/pocs/binary/2026-07-27_greatxml-winre-bitlocker-bypass/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_greatxml-winre-bitlocker-bypass/High severity — binary · N/A (no CVE assigned, no Microsoft advisory as of 2026-07-27). Status: Unpatched. Affects: Windows Recovery Environment (WinRE) — Microsoft Defender Offline Scan launch path (ReAgent.xml scheduled operation). Tags: windows, bitlocker, winre, defender, offline-scan, trust-boundary-bypass, zero-day, unpatched, physical-access, local.binaryHighwindowsbitlockerwinredefenderoffline-scantrust-boundary-bypasszero-dayunpatchedphysical-accesslocalhttps://poc.intelseclab.com/pocs/binary/2026-07-08_cve-2026-43499-ghostlock-nebula-security/Wed, 08 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-08_cve-2026-43499-ghostlock-nebula-security/High severity (CVSS 7.8) — binary · CVE-2026-43499 (aka "GhostLock"). Status: Weaponized (per Nebula Security disclosure); no exploit code mirrored into this repo, see Notes. Affects: Linux kernel — rtmutex priority-inheritance (futex-PI) subsystem, CONFIG_FUTEX_PI. Tags: linux-kernel, use-after-free, futex, rtmutex, priority-inheritance, lpe, local, container-escape, kernelctf, ghostlock.binaryHighlinux-kerneluse-after-freefutexrtmutexpriority-inheritancelpelocalcontainer-escapekernelctfghostlockhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-40369-windows-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-40369-windows-kernel-lpe/High severity — binary · CVE-2026-40369. Status: PoC. Affects: Windows kernel (ntoskrnl.exe). Tags: windows, kernel, lpe, privilege-escalation, token-stealing, sedebugprivilege, ntoskrnl, local.binaryHighwindowskernellpeprivilege-escalationtoken-stealingsedebugprivilegentoskrnllocalhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43494-pintheft-nasm-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43494-pintheft-nasm-kernel-lpe/High severity — binary · CVE-2026-43494. Status: PoC. Affects: Linux kernel (RDS zerocopy send path + io_uring fixed buffers). Tags: linux-kernel, lpe, double-free, use-after-free, rds, io_uring, page-cache-overwrite, x86_64, nasm, asm, local, root-shell.binaryHighlinux-kernellpedouble-freeuse-after-freerdsio_uringpage-cache-overwritex86_64nasmasmlocalroot-shellhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf/High severity (CVSS 7.8) — binary · CVE-2026-43499. Status: PoC. Affects: Linux kernel — kernel/locking/rtmutex.c, futex-PI subsystem (futex_requeue() / rt_mutex_start_proxy_lock()). Tags: linux-kernel, android, use-after-free, futex, rtmutex, priority-inheritance, lpe, local, kernel-panic, ndk.binaryHighlinux-kernelandroiduse-after-freefutexrtmutexpriority-inheritancelpelocalkernel-panicndkhttps://poc.intelseclab.com/pocs/binary/2026-06-10_rogueplanet-defender-lpe/Wed, 10 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-10_rogueplanet-defender-lpe/High severity (CVSS 7.8) — binary · CVE-2026-50656. Status: Weaponized. Affects: Microsoft Windows Defender / Windows Error Reporting Task Scheduler. Tags: LPE, Windows Defender, race-condition, TOCTOU, ISO-mount, VirtualDisk, Task-Scheduler, WER, EICAR, SYSTEM-shell, Windows-10, Windows-11, local.binaryHighLPEWindows Defenderrace-conditionTOCTOUISO-mountVirtualDiskTask-SchedulerWEREICARSYSTEM-shellWindows-10Windows-11localhttps://poc.intelseclab.com/pocs/binary/2026-05-28_notepad-plus-plus-8-9-6-multi-cve/Thu, 28 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-28_notepad-plus-plus-8-9-6-multi-cve/High severity (CVSS 5) — binary · CVE-2026-48770, CVE-2026-48778, CVE-2026-48800. Status: Patched. Affects: Notepad++. Tags: Notepad++, Windows, OOB-read, DoS, command-injection, config.xml, shortcuts.xml, local.binaryHighNotepad++WindowsOOB-readDoScommand-injectionconfig.xmlshortcuts.xmllocalhttps://poc.intelseclab.com/pocs/binary/2026-05-20_pintheft-rds-double-free/Wed, 20 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-20_pintheft-rds-double-free/High severity — binary. Status: Weaponized. Affects: Linux kernel (RDS subsystem + io_uring). Tags: LPE, double-free, use-after-free, Linux kernel, RDS, io_uring, page-cache-overwrite, x86_64, local.binaryHighLPEdouble-freeuse-after-freeLinux kernelRDSio_uringpage-cache-overwritex86_64localhttps://poc.intelseclab.com/pocs/binary/2026-05-17_copy-fail-cve-2026-31431/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_copy-fail-cve-2026-31431/High severity — binary · CVE-2026-31431. Status: Weaponized. Affects: Linux kernel (crypto / AF_ALG AEAD path). Tags: LPE, Linux kernel, AF_ALG, authenc, splice, local, Python.binaryHighLPELinux kernelAF_ALGauthencsplicelocalPythonhttps://poc.intelseclab.com/pocs/binary/2026-05-16_qemutiny-memory-corruption/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-16_qemutiny-memory-corruption/Critical severity — binary. Status: Weaponized. Affects: QEMU CXL Type-3 device emulation (hw/cxl/cxl-mailbox-utils.c). Tags: QEMU, CXL, memory-corruption, OOB-read, OOB-write, guest-to-host-escape, local, root-in-guest.binaryCriticalQEMUCXLmemory-corruptionOOB-readOOB-writeguest-to-host-escapelocalroot-in-guesthttps://poc.intelseclab.com/pocs/binary/2026-05-14_linux-xfrm-rxrpc-lpe/Thu, 14 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-14_linux-xfrm-rxrpc-lpe/Critical severity (CVSS 7.8) — binary · CVE-2026-43500, CVE-2026-43284. Status: Weaponized. Affects: Linux kernel. Tags: LPE, Linux kernel, page-cache, xfrm, RxRPC, local, unauthenticated, Dirty Pipe variant.binaryCriticalLPELinux kernelpage-cachexfrmRxRPClocalunauthenticatedDirty Pipe variant