https://poc.intelseclab.com/tags/lpe/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-21508-windows-mediaplayer-dll-hijack-lpe/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-21508-windows-mediaplayer-dll-hijack-lpe/High severity (CVSS 7.8) — binary · CVE-2026-21508. Status: Patched. Affects: Microsoft Windows Media Player / WUDFHost.exe. Tags: windows, dll-hijack, lpe, privilege-escalation, media-player, wudfhost, session0, com-hijack, CVE-2026-21508.binaryHighwindowsdll-hijacklpeprivilege-escalationmedia-playerwudfhostsession0com-hijackCVE-2026-21508https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-68398-ubuntu-pppol2tp-uaf-lpe/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-68398-ubuntu-pppol2tp-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2026-68398. Status: Patched. Affects: Linux Kernel (PPPoL2TP subsystem). Tags: linux, kernel, ubuntu, pppol2tp, l2tp, ppp, uaf, use-after-free, race-condition, lpe, privilege-escalation, kaslr-bypass, apparmor-bypass, suid, heap-spray, kmalloc-256, CVE-2026-68398.binaryHighlinuxkernelubuntupppol2tpl2tppppuafuse-after-freerace-conditionlpeprivilege-escalationkaslr-bypassapparmor-bypasssuidheap-spraykmalloc-256CVE-2026-68398https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-23111-nftables-catchall-uaf-lpe/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-23111-nftables-catchall-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2026-23111. Status: Patched. Affects: Linux kernel (nf_tables subsystem). Tags: linux, kernel, nftables, nf-tables, uaf, catchall, lpe, privilege-escalation, slab-spray, kaslr-bypass, rop, namespace, CVE-2026-23111.binaryHighlinuxkernelnftablesnf-tablesuafcatchalllpeprivilege-escalationslab-spraykaslr-bypassropnamespaceCVE-2026-23111https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-53361-afunix-gc-peek-uaf-container-escape/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-53361-afunix-gc-peek-uaf-container-escape/Critical severity (CVSS 9.8) — binary · CVE-2026-53361. Status: Patched. Affects: Linux Kernel (AF_UNIX socket garbage collector). Tags: linux, kernel, af-unix, garbage-collector, msg-peek, uaf, container-escape, lpe, slub, dirty-pagetable, CVE-2026-53361.binaryCriticallinuxkernelaf-unixgarbage-collectormsg-peekuafcontainer-escapelpeslubdirty-pagetableCVE-2026-53361https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-64564-sctphantom-sctp-asconf-uaf-lpe/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-64564-sctphantom-sctp-asconf-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2026-64564. Status: Patched. Affects: Linux kernel, SCTP (Stream Control Transmission Protocol) ASCONF subsystem. Tags: linux, kernel, lpe, sctp, use-after-free, asconf, del-ip, heap-spray, packet-tx-ring, kaslr-bypass, credential-overwrite, debian, CWE-416, CVE-2026-64564.binaryHighlinuxkernellpesctpuse-after-freeasconfdel-ipheap-spraypacket-tx-ringkaslr-bypasscredential-overwritedebianCWE-416CVE-2026-64564https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-68138-linux-qdisc-ratetable-race-lpe/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-68138-linux-qdisc-ratetable-race-lpe/High severity (CVSS 7.8) — binary · CVE-2026-68138. Status: Patched. Affects: Linux kernel, traffic-control qdisc rate-table subsystem (qdisc_get_rtab / qdisc_put_rtab). Tags: linux, kernel, lpe, race-condition, use-after-free, qdisc, traffic-control, flower, bpf, pipe, page-cache, modprobe, CWE-362, CWE-416, CVE-2026-68138.binaryHighlinuxkernellperace-conditionuse-after-freeqdisctraffic-controlflowerbpfpipepage-cachemodprobeCWE-362CWE-416CVE-2026-68138https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-64531-ovswrap-linux-ovs-lpe/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-64531-ovswrap-linux-ovs-lpe/High severity (CVSS 7.8) — binary · CVE-2026-64531. Status: Patched. Affects: Linux kernel, Open vSwitch (OVS) kernel module, conntrack subsystem. Tags: linux, kernel, lpe, openvswitch, ovs, conntrack, netlink, memory-corruption, sudoers, CVE-2026-64531.binaryHighlinuxkernellpeopenvswitchovsconntracknetlinkmemory-corruptionsudoersCVE-2026-64531https://poc.intelseclab.com/pocs/binary/2026-08-11_shieldbreak-defender-rogueplanet-patch-bypass/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-11_shieldbreak-defender-rogueplanet-patch-bypass/High severity (CVSS 7.8) — binary · Bypass of CVE-2026-50656 (RoguePlanet); no CVE assigned to ShieldBreak as of 2026-08-11. Status: Unpatched. Affects: Microsoft Windows Defender (Antimalware Service Executable / MsMpEng.exe), threat remediation subsystem. Tags: windows, windows-defender, lpe, privilege-escalation, 0day, patch-bypass, cloud-files, cfapi, object-manager, symlink, wer, dll-sideload, CWE-59, CWE-426, microsoft, rogueplanet, shieldbreak.binaryHighwindowswindows-defenderlpeprivilege-escalation0daypatch-bypasscloud-filescfapiobject-managersymlinkwerdll-sideloadCWE-59CWE-426microsoftrogueplanetshieldbreakhttps://poc.intelseclab.com/pocs/binary/2026-08-01_notcve-2026-0010-barrier-daemon-lpe/Sat, 01 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-01_notcve-2026-0010-barrier-daemon-lpe/High severity — binary · NotCVE-2026-0010 (disputed CVE assignment — author contests the identifier). Status: Unpatched — Barrier is unmaintained with no vendor fix; patched successor Deskflow covers the same issue via CVE-2026-41477 / GHSA-6rx5-g478-775c. Affects: Barrier (debauchee), Windows service daemon barrierd.exe. Tags: barrier, barrierd, windows, ipc, tcp-24801, unauthenticated, lpe, privilege-escalation, system, cwe-306, local.binaryHighbarrierbarrierdwindowsipctcp-24801unauthenticatedlpeprivilege-escalationsystemcwe-306localhttps://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-49176-windows-walletservice-lpe/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-49176-windows-walletservice-lpe/High severity (CVSS 7.8) — binary · CVE-2026-49176. Status: Weaponized — SYSTEM shell confirmed against a real, vulnerable Windows 11 build. Affects: Windows WalletService (Windows.ApplicationModel.Wallet WinRT API, backed by an ESE/Jet Blue database under the caller's Documents\Wallet folder). Tags: windows, walletservice, lpe, privilege-escalation, ese, extensible-storage-engine, known-folder-redirection, persisted-callback, local.binaryHighwindowswalletservicelpeprivilege-escalationeseextensible-storage-engineknown-folder-redirectionpersisted-callbacklocalhttps://poc.intelseclab.com/pocs/binary/2026-07-19_legacyhive-user-profile-service-hive-load-lpe/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-19_legacyhive-user-profile-service-hive-load-lpe/High severity — binary. Status: Weaponized. Affects: Microsoft Windows user profile service / registry hive loading path. Tags: windows, lpe, user-profile-service, registry-hive, usrclass.dat, oplock, symbolic-link.binaryHighwindowslpeuser-profile-serviceregistry-hiveusrclass.datoplocksymbolic-linkhttps://poc.intelseclab.com/pocs/binary/2026-07-08_cve-2026-43499-ghostlock-nebula-security/Wed, 08 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-08_cve-2026-43499-ghostlock-nebula-security/High severity (CVSS 7.8) — binary · CVE-2026-43499 (aka "GhostLock"). Status: Weaponized (per Nebula Security disclosure); no exploit code mirrored into this repo, see Notes. Affects: Linux kernel — rtmutex priority-inheritance (futex-PI) subsystem, CONFIG_FUTEX_PI. Tags: linux-kernel, use-after-free, futex, rtmutex, priority-inheritance, lpe, local, container-escape, kernelctf, ghostlock.binaryHighlinux-kerneluse-after-freefutexrtmutexpriority-inheritancelpelocalcontainer-escapekernelctfghostlockhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-29923-pstrip64-driver-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-29923-pstrip64-driver-lpe/Critical severity — binary · CVE-2026-29923. Status: Weaponized. Affects: pstrip64.sys kernel driver (EnTech Taiwan PowerStrip, up to version 3.90.736). Tags: byovd, windows-kernel, lpe, physical-memory, eprocess, token-theft, driver, ioctl.binaryCriticalbyovdwindows-kernellpephysical-memoryeprocesstoken-theftdriverioctlhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-40369-windows-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-40369-windows-kernel-lpe/High severity — binary · CVE-2026-40369. Status: PoC. Affects: Windows kernel (ntoskrnl.exe). Tags: windows, kernel, lpe, privilege-escalation, token-stealing, sedebugprivilege, ntoskrnl, local.binaryHighwindowskernellpeprivilege-escalationtoken-stealingsedebugprivilegentoskrnllocalhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20817-windows-wer-alpc-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20817-windows-wer-alpc-lpe/High severity — binary · CVE-2026-20817. Status: PoC. Affects: Windows Error Reporting Service (WerSvc). Tags: windows, wersvc, alpc, lpe, privilege-escalation, ntdll, system32, native-cpp.binaryHighwindowswersvcalpclpeprivilege-escalationntdllsystem32native-cpphttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-21018-samsung-sveservice-oob-write-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-21018-samsung-sveservice-oob-write-lpe/High severity — binary · CVE-2026-21018 (Samsung SVE-2026-0478, SMR May 2026). Status: PoC. Affects: Samsung SveService (com.sec.sve) system service and its libsvejni.so native library. Tags: android, samsung, binder, native, out-of-bounds-write, jni, lpe, memcpy, memset.binaryHighandroidsamsungbindernativeout-of-bounds-writejnilpememcpymemsethttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3437-portwell-sys-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3437-portwell-sys-lpe/High severity — binary · CVE-2026-3437. Status: PoC. Affects: Portwell Engineering Toolkits driver, portwell.sys (v4.8.2). Tags: byovd, windows-driver, kernel, lpe, physical-memory, ioctl, privilege-escalation.binaryHighbyovdwindows-driverkernellpephysical-memoryioctlprivilege-escalationhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43494-pintheft-nasm-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43494-pintheft-nasm-kernel-lpe/High severity — binary · CVE-2026-43494. Status: PoC. Affects: Linux kernel (RDS zerocopy send path + io_uring fixed buffers). Tags: linux-kernel, lpe, double-free, use-after-free, rds, io_uring, page-cache-overwrite, x86_64, nasm, asm, local, root-shell.binaryHighlinux-kernellpedouble-freeuse-after-freerdsio_uringpage-cache-overwritex86_64nasmasmlocalroot-shellhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41651-packagekit-toctou-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41651-packagekit-toctou-lpe/High severity — binary · CVE-2026-41651. Status: PoC. Affects: PackageKit daemon (packagekitd). Tags: linux, packagekit, toctou, race-condition, lpe, polkit, privilege-escalation, dbus.binaryHighlinuxpackagekittoctourace-conditionlpepolkitprivilege-escalationdbushttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36981-minitool-kernel-driver-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36981-minitool-kernel-driver-lpe/High severity — binary · CVE-2026-36981. Status: PoC. Affects: MiniTool pwdrvio.sys kernel driver. Tags: minitool, kernel-driver, write-what-where, lpe, arbitrary-kernel-write, windows.binaryHighminitoolkernel-driverwrite-what-wherelpearbitrary-kernel-writewindowshttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41091-defender-link-following-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41091-defender-link-following-lpe/High severity (CVSS 7.8) — binary · CVE-2026-41091. Status: Weaponized. Affects: Microsoft Defender / Microsoft Malware Protection Engine. Tags: windows, microsoft-defender, link-following, cwe-59, cloud-files-api, ntfs-junction, oplock, privilege-escalation, lpe.binaryHighwindowsmicrosoft-defenderlink-followingcwe-59cloud-files-apintfs-junctionoplockprivilege-escalationlpehttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf/High severity (CVSS 7.8) — binary · CVE-2026-43499. Status: PoC. Affects: Linux kernel — kernel/locking/rtmutex.c, futex-PI subsystem (futex_requeue() / rt_mutex_start_proxy_lock()). Tags: linux-kernel, android, use-after-free, futex, rtmutex, priority-inheritance, lpe, local, kernel-panic, ndk.binaryHighlinux-kernelandroiduse-after-freefutexrtmutexpriority-inheritancelpelocalkernel-panicndkhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31694-fuse-readdir-cache-oob/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31694-fuse-readdir-cache-oob/High severity — binary · CVE-2026-31694. Status: Weaponized. Affects: Linux kernel — fs/fuse/readdir.c (fuse_add_dirent_to_cache()). Tags: linux-kernel, fuse, oob-write, page-cache, lpe, groom, unprivileged, qemu-kvm.binaryHighlinux-kernelfuseoob-writepage-cachelpegroomunprivilegedqemu-kvmhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31413-bpf-verifier-container-escape/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31413-bpf-verifier-container-escape/Critical severity — binary · CVE-2026-31413. Status: Weaponized. Affects: Linux kernel — BPF verifier (maybe_fork_scalars()). Tags: linux-kernel, ebpf, bpf-verifier, container-escape, modprobe-path, gke, lpe, vtable-hijack.binaryCriticallinux-kernelebpfbpf-verifiercontainer-escapemodprobe-pathgkelpevtable-hijackhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-28372-telnetd-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-28372-telnetd-lpe/High severity (CVSS 7.4) — binary · CVE-2026-28372. Status: PoC. Affects: GNU inetutils telnetd. Tags: telnetd, inetutils, lpe, new-environ, login-noauth, authentication-bypass, privilege-escalation, util-linux.binaryHightelnetdinetutilslpenew-environlogin-noauthauthentication-bypassprivilege-escalationutil-linuxhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-45250-setcred-freebsd-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-45250-setcred-freebsd-lpe/Critical severity — binary · CVE-2026-45250. Status: PoC. Affects: FreeBSD kernel — setcred(2) system call (sys/kern/kern_prot.c). Tags: freebsd, kernel, lpe, privilege-escalation, stack-overflow, setcred, smap-bypass, smep-bypass, zfs, kernel-exploit.binaryCriticalfreebsdkernellpeprivilege-escalationstack-overflowsetcredsmap-bypasssmep-bypasszfskernel-exploithttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-7270-freebsd-execargs-oob-memmove-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-7270-freebsd-execargs-oob-memmove-lpe/Critical severity — binary · CVE-2026-7270. Status: Weaponized. Affects: FreeBSD kernel — sys/kern/kern_exec.c exec_args_adjust_args(). Tags: freebsd, kernel, lpe, memmove, oob, race-condition, ld_preload, sshd, cwe-190, cwe-787.binaryCriticalfreebsdkernellpememmoveoobrace-conditionld_preloadsshdcwe-190cwe-787https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-45258-1day-lpe-exploit/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-45258-1day-lpe-exploit/Critical severity — binary · CVE-2026-45258. Status: PoC. Affects: FreeBSD kernel (OSS//dev/dsp sound driver mmap handling). Tags: freebsd, kernel, lpe, privilege-escalation, oss, dev-dsp, mmap, setuid, 1day.binaryCriticalfreebsdkernellpeprivilege-escalationossdev-dspmmapsetuid1dayhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31635-dirtydecrypt-go-rxgk-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31635-dirtydecrypt-go-rxgk-lpe/High severity — binary · CVE-2026-31635. Status: Weaponized. Affects: Linux kernel — net/rxrpc/rxgk_common.h (rxgk_decrypt_skb()). Tags: linux-kernel, lpe, rxrpc, rxgk, page-cache, dirty-pipe-variant, splice, golang, unprivileged.binaryHighlinux-kernellperxrpcrxgkpage-cachedirty-pipe-variantsplicegolangunprivilegedhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-1880-asus-driverhub-toctou-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-1880-asus-driverhub-toctou-lpe/Medium severity — binary · CVE-2026-1880. Status: PoC. Affects: ASUS DriverHub (driver update utility). Tags: windows, toctou, race-condition, lpe, driverhub, asus, local-privilege-escalation, shellexecute.binaryMediumwindowstoctourace-conditionlpedriverhubasuslocal-privilege-escalationshellexecutehttps://poc.intelseclab.com/pocs/binary/2026-07-03_systeminformer-phsvc-trusted-host-lpe/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-03_systeminformer-phsvc-trusted-host-lpe/High severity — binary · None assigned as of 2026-07-03. Status: PoC. Affects: System Informer (Process Hacker successor), phsvc helper process. Tags: windows, system-informer, process-hacker, lpe, confused-deputy, alpc, phsvc, authenticode, local-privilege-escalation.binaryHighwindowssystem-informerprocess-hackerlpeconfused-deputyalpcphsvcauthenticodelocal-privilege-escalationhttps://poc.intelseclab.com/pocs/binary/2026-07-03_anydesk-printer-pipe-com-impersonation-lpe/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-03_anydesk-printer-pipe-com-impersonation-lpe/High severity — binary · None assigned as of 2026-07-03. Status: PoC. Affects: AnyDesk for Windows 9.7.6. Tags: anydesk, windows, privilege-escalation, com-impersonation, named-pipe, local-service, lpe, ipc.binaryHighanydeskwindowsprivilege-escalationcom-impersonationnamed-pipelocal-servicelpeipchttps://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-46331-linux-act-pedit-lpe/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-46331-linux-act-pedit-lpe/High severity (CVSS 7.8) — binary · CVE-2026-46331. Status: PoC. Affects: Linux Kernel — net/sched/act_pedit (traffic control packet editing). Tags: LPE, Linux kernel, COW, page-cache, act_pedit, tc, netlink, traffic-control, privilege-escalation, userns, C, DirtyFrag.binaryHighLPELinux kernelCOWpage-cacheact_pedittcnetlinktraffic-controlprivilege-escalationusernsCDirtyFraghttps://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-7574-claude-desktop-cowork-vm-bypass/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-7574-claude-desktop-cowork-vm-bypass/High severity (CVSS 8.7) — binary · CVE-2026-7574. Status: PoC. Affects: Anthropic Claude Desktop — Cowork feature. Tags: LPE, persistence, VM-integrity, rootfs, Claude, AI-application, macOS, ext4, integrity-bypass, Shell.binaryHighLPEpersistenceVM-integrityrootfsClaudeAI-applicationmacOSext4integrity-bypassShellhttps://poc.intelseclab.com/pocs/binary/2026-06-28_cve-2026-45586-ctfmon-greenplasma-lpe/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-28_cve-2026-45586-ctfmon-greenplasma-lpe/High severity (CVSS 7.8) — binary · CVE-2026-45586. Status: PoC. Affects: Windows Collaborative Translation Framework (CTFMON service). Tags: LPE, EoP, Windows, CTFMON, section-object, object-directory, link-following, zero-day, CTF-challenge, Windows-11, Windows-2022, Windows-2026, incomplete-poc.binaryHighLPEEoPWindowsCTFMONsection-objectobject-directorylink-followingzero-dayCTF-challengeWindows-11Windows-2022Windows-2026incomplete-pochttps://poc.intelseclab.com/pocs/binary/2026-06-28_dirtyclone-cve-2026-43503-lpe/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-28_dirtyclone-cve-2026-43503-lpe/High severity (CVSS 8.8) — binary · CVE-2026-43503. Status: Weaponized. Affects: Linux kernel (netfilter TEE / __pskb_copy_fclone()). Tags: LPE, Linux kernel, netfilter, TEE, IPsec, XFRM, page-cache, file-backed memory, DirtyFrag, skb, privilege escalation, C, in-the-wild.binaryHighLPELinux kernelnetfilterTEEIPsecXFRMpage-cachefile-backed memoryDirtyFragskbprivilege escalationCin-the-wildhttps://poc.intelseclab.com/pocs/binary/2026-06-26_cve-2026-50656-rogueplanet-checker/Fri, 26 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-26_cve-2026-50656-rogueplanet-checker/High severity (CVSS 7.8) — binary · CVE-2026-50656. Status: Researched. Affects: Microsoft Malware Protection Engine (mpengine.dll, MsMpEng.exe). Tags: LPE, Windows Defender, TOCTOU, symlink, reparse-point, junction, CWE-59, checker, detection, non-destructive, MsMpEng.binaryHighLPEWindows DefenderTOCTOUsymlinkreparse-pointjunctionCWE-59checkerdetectionnon-destructiveMsMpEnghttps://poc.intelseclab.com/pocs/binary/2026-06-10_rogueplanet-defender-lpe/Wed, 10 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-10_rogueplanet-defender-lpe/High severity (CVSS 7.8) — binary · CVE-2026-50656. Status: Weaponized. Affects: Microsoft Windows Defender / Windows Error Reporting Task Scheduler. Tags: LPE, Windows Defender, race-condition, TOCTOU, ISO-mount, VirtualDisk, Task-Scheduler, WER, EICAR, SYSTEM-shell, Windows-10, Windows-11, local.binaryHighLPEWindows Defenderrace-conditionTOCTOUISO-mountVirtualDiskTask-SchedulerWEREICARSYSTEM-shellWindows-10Windows-11localhttps://poc.intelseclab.com/pocs/binary/2026-06-05_ssh-keysign-pwn/Fri, 05 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-05_ssh-keysign-pwn/High severity — binary · CVE-2026-46333. Status: Patched. Affects: Linux kernel plus privileged userland binaries (ssh-keysign, chage). Tags: LPE, Linux kernel, pidfd_getfd, ptrace, ssh-keysign, chage, fd-theft.binaryHighLPELinux kernelpidfd_getfdptracessh-keysignchagefd-thefthttps://poc.intelseclab.com/pocs/binary/2026-05-20_pintheft-rds-double-free/Wed, 20 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-20_pintheft-rds-double-free/High severity — binary. Status: Weaponized. Affects: Linux kernel (RDS subsystem + io_uring). Tags: LPE, double-free, use-after-free, Linux kernel, RDS, io_uring, page-cache-overwrite, x86_64, local.binaryHighLPEdouble-freeuse-after-freeLinux kernelRDSio_uringpage-cache-overwritex86_64localhttps://poc.intelseclab.com/pocs/network/2026-05-18_tossup-terramaster-redis-rce/Mon, 18 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-18_tossup-terramaster-redis-rce/Critical severity — network · N/A (vendor confirmed TOS4 is EOL; no fix planned). Status: Weaponized. Affects: TerraMaster TOS3_A1.0 4.2.41, Redis 4.0.10. Tags: RCE, unauthenticated, Redis, TerraMaster, NAS, AArch64, root, module-loading, replication-abuse, NFS, no_root_squash, LPE, network.networkCriticalRCEunauthenticatedRedisTerraMasterNASAArch64rootmodule-loadingreplication-abuseNFSno_root_squashLPEnetworkhttps://poc.intelseclab.com/pocs/binary/2026-05-18_dirtydecrypt/Mon, 18 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-18_dirtydecrypt/High severity — binary · N/A (reported as duplicate by kernel maintainers; patched on mainline). Status: Weaponized. Affects: Linux kernel — net/rxrpc (rxgk_decrypt_skb). Tags: LPE, Linux kernel, page-cache, rxgk, RxRPC, COW, write-primitive, unprivileged, Dirty-Pipe-variant, splice, MSG_SPLICE_PAGES.binaryHighLPELinux kernelpage-cacherxgkRxRPCCOWwrite-primitiveunprivilegedDirty-Pipe-variantspliceMSG_SPLICE_PAGEShttps://poc.intelseclab.com/pocs/binary/2026-05-17_linux-vsock-vm-escape/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_linux-vsock-vm-escape/High severity (CVSS 7.8) — binary · CVE-2025-21756. Status: Weaponized. Affects: Linux kernel (vsock / virtual socket subsystem). Tags: UAF, Linux kernel, vsock, VM escape, container escape, virtualization, LPE, x64.binaryHighUAFLinux kernelvsockVM escapecontainer escapevirtualizationLPEx64https://poc.intelseclab.com/pocs/binary/2026-05-17_linux-nftables-uaf-lpe/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_linux-nftables-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2024-1086. Status: Weaponized. Affects: Linux kernel (netfilter nf_tables subsystem). Tags: LPE, UAF, Linux kernel, nf_tables, netfilter, CISA KEV, ransomware, x64.binaryHighLPEUAFLinux kernelnf_tablesnetfilterCISA KEVransomwarex64https://poc.intelseclab.com/pocs/binary/2026-05-17_copy-fail-cve-2026-31431/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_copy-fail-cve-2026-31431/High severity — binary · CVE-2026-31431. Status: Weaponized. Affects: Linux kernel (crypto / AF_ALG AEAD path). Tags: LPE, Linux kernel, AF_ALG, authenc, splice, local, Python.binaryHighLPELinux kernelAF_ALGauthencsplicelocalPythonhttps://poc.intelseclab.com/pocs/binary/2026-05-15_redsun-privileged-file-write/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_redsun-privileged-file-write/High severity (CVSS 7.8) — binary · CVE-2026-33825. Status: Weaponized. Affects: Microsoft Defender Antivirus (real-time protection) on Windows with Cloud Files APIs. Tags: LPE, privileged-file-write, Windows Defender, Cloud Files API, TOCTOU, file-reparse-point.binaryHighLPEprivileged-file-writeWindows DefenderCloud Files APITOCTOUfile-reparse-pointhttps://poc.intelseclab.com/pocs/binary/2026-05-15_miniplasma-cve-2020-17103/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_miniplasma-cve-2020-17103/High severity (CVSS 7.8) — binary · CVE-2020-17103. Status: Weaponized. Affects: Windows Cloud Files Mini Filter Driver (cldflt.sys) / cldapi.dll. Tags: LPE, Windows, cldflt.sys, Cloud Files API, registry-symlink, race-condition, WER-hijack, SYSTEM-shell, local-user.binaryHighLPEWindowscldflt.sysCloud Files APIregistry-symlinkrace-conditionWER-hijackSYSTEM-shelllocal-userhttps://poc.intelseclab.com/pocs/binary/2026-05-15_cve-2024-21338-admin-to-kernel/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_cve-2024-21338-admin-to-kernel/High severity (CVSS 7.8) — binary · CVE-2024-21338. Status: Weaponized. Affects: Microsoft Windows AppLocker driver path (\\Device\\AppID). Tags: LPE, Windows, AppLocker, token-impersonation, HVCI, admin-to-kernel, local-user.binaryHighLPEWindowsAppLockertoken-impersonationHVCIadmin-to-kernellocal-userhttps://poc.intelseclab.com/pocs/binary/2026-05-15_bluehammer-defender-lpe/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_bluehammer-defender-lpe/High severity (CVSS 7.8) — binary · CVE-2026-33825. Status: Weaponized. Affects: Microsoft Defender Antivirus update/scan workflow on Windows. Tags: LPE, Windows Defender, VSS, SAM-hive-leak, RPC, local-user.binaryHighLPEWindows DefenderVSSSAM-hive-leakRPClocal-userhttps://poc.intelseclab.com/pocs/binary/2026-05-14_linux-xfrm-fragnesia-lpe/Thu, 14 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-14_linux-xfrm-fragnesia-lpe/High severity (CVSS 7.8) — binary · CVE-2026-46300. Status: Weaponized. Affects: Linux kernel (XFRM ESP-in-TCP subsystem). Tags: LPE, privilege-escalation, kernel, XFRM, ESP-in-TCP, page-cache, write-primitive, unprivileged.binaryHighLPEprivilege-escalationkernelXFRMESP-in-TCPpage-cachewrite-primitiveunprivileged