tag
TOCTOU
Windows Push Notification Service Use-After-Free Race (CVE-2026-42978)
CVE-2026-42978 is a use-after-free race condition (CWE-362) in wpncore.dll's PresentationEndpointFacade class, which backs the WpnService Windows Push Notification service running as NT AUTHORITY\SYSTEM. Facade methods (e.g. ToastUnblockAll) fetch a pointer…
PackageKit TOCTOU Local Privilege Escalation (CVE-2026-41651)
PackageKit's transaction handling in src/pk-transaction.c contains a set of logic flaws that combine into a TOCTOU (time-of-check to time-of-use) race condition, nicknamed "Pack2TheRoot" by the researcher. InstallFiles() overwrites cached transaction…
Balena Etcher Windows TOCTOU Privilege Escalation — CVE-2026-30332
Balena Etcher for Windows writes a temporary .cmd script (containing environment variables and the command to launch etcher-util.exe) to a user-writable temp directory and then executes it with elevated privileges via a UAC prompt. Because there is a time gap…
ASUS DriverHub Update TOCTOU Local Privilege Escalation — CVE-2026-1880
ASUS DriverHub updates drivers by downloading a package, extracting it to C:\ProgramData\ASUS\AsusDriverHub\SupportTemp\<drivername>, and later launching setup.exe from that directory via ShellExecuteExW. Because the driver folder name can be predicted from…
Amazon WorkSpaces Skylight Workspace Config Service Local Privilege Escalation (CVE-2026-7791)
The Skylight Workspace Config Service on Amazon WorkSpaces runs as SYSTEM and performs scheduled log rotation under C:\ProgramData\Amazon. Permissive ACLs on this directory, a ROTATE directory junction, absence of file-type checks, and a ~1-10 ms TOCTOU…
AI Model-Loader `trust_remote_code` Order-of-Operations RCE Simulation (CVE-2026-22807)
This repository is a small, self-contained Python testbed (vulnerablelib.py) that reproduces a class of AI supply-chain vulnerability found in model-loading frameworks: when a loader resolves a model's Python class via a config.json's automap field, it can…
Docker cp Copy-Out Destination Escape via Symlink Race
docker cp copy-out operations are vulnerable to a time-of-check/time-of-use race: the daemon walks the container's source path with filepath.WalkDir and builds a tar stream, but if a container process changes a directory entry (e.g., swaps it for a symlink)…
CVE-2026-50656 RoguePlanet — Safe Vulnerability Checker (Resurface)
CVE-2026-50656 is a High-severity Elevation of Privilege vulnerability in the Microsoft Malware Protection Engine, publicly referred to as RoguePlanet. It stems from improper link resolution before file access (CWE-59) — the engine follows attacker-controlled…
RoguePlanet — Windows Defender LPE via ISO Mount + Task Scheduler Race Condition
RoguePlanet is a local privilege escalation exploit for Windows 10 and 11 that abuses a race condition in Windows Defender's scan pipeline. The exploit mounts an attacker-controlled ISO image via the VirtualDisk API, plants an EICAR-like trigger file inside…
FirefUXSS: Universal XSS in Firefox Focus for iOS via Redirect-Scheme Validation Race Condition
FirefUXSS is a universal XSS issue in Firefox Focus for iOS where redirect-scheme validation can be bypassed via a race condition. A burst of benign redirects can desynchronize validation from navigation commit, allowing a final javascript: redirect to…
RedSun Privileged File Write (CVE-2026-33825)
RedSun documents a local privilege-escalation technique where Defender's handling of a cloud-tagged malicious file can be abused as a privileged file write primitive. The PoC orchestrates file operations so the antimalware rewrite path lands on a high-value…