https://poc.intelseclab.com/tags/toctou/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-42978-wpn-uaf-race/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-42978-wpn-uaf-race/High severity (CVSS 7.8) — binary · CVE-2026-42978. Status: PoC. Affects: Windows Push Notifications service (WpnService, wpncore.dll). Tags: windows, kernel, wpnservice, use-after-free, race-condition, toctou, privilege-escalation, etw, sysmon, patch-diffing.binaryHighwindowskernelwpnserviceuse-after-freerace-conditiontoctouprivilege-escalationetwsysmonpatch-diffinghttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41651-packagekit-toctou-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41651-packagekit-toctou-lpe/High severity — binary · CVE-2026-41651. Status: PoC. Affects: PackageKit daemon (packagekitd). Tags: linux, packagekit, toctou, race-condition, lpe, polkit, privilege-escalation, dbus.binaryHighlinuxpackagekittoctourace-conditionlpepolkitprivilege-escalationdbushttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-30332-balena-etcher-toctou/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-30332-balena-etcher-toctou/High severity — binary · CVE-2026-30332. Status: Weaponized. Affects: Balena Etcher for Windows. Tags: toctou, windows, uac, privilege-escalation, balena-etcher, race-condition, temp-file.binaryHightoctouwindowsuacprivilege-escalationbalena-etcherrace-conditiontemp-filehttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-1880-asus-driverhub-toctou-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-1880-asus-driverhub-toctou-lpe/Medium severity — binary · CVE-2026-1880. Status: PoC. Affects: ASUS DriverHub (driver update utility). Tags: windows, toctou, race-condition, lpe, driverhub, asus, local-privilege-escalation, shellexecute.binaryMediumwindowstoctourace-conditionlpedriverhubasuslocal-privilege-escalationshellexecutehttps://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-7791-aws-workspaces-skylight-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-7791-aws-workspaces-skylight-lpe/High severity — cloud · CVE-2026-7791. Status: PoC. Affects: Amazon WorkSpaces — Skylight Workspace Config Service. Tags: aws, amazon-workspaces, skylight, toctou, privilege-escalation, arbitrary-file-write, windows, directory-junction.cloudHighawsamazon-workspacesskylighttoctouprivilege-escalationarbitrary-file-writewindowsdirectory-junctionhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-22807-vllm-trust-remote-code-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-22807-vllm-trust-remote-code-bypass/High severity — misc · CVE-2026-22807. Status: PoC. Affects: AI inference/model-loading frameworks that resolve custom model classes via auto_map before validating trust_remote_code (pattern seen in vLLM/Transformers-style loaders). Tags: vllm, huggingface, trust-remote-code, toctou, model-loading, supply-chain, python, code-execution.miscHighvllmhuggingfacetrust-remote-codetoctoumodel-loadingsupply-chainpythoncode-executionhttps://poc.intelseclab.com/pocs/cloud/2026-07-03_docker-cp-copyout-destination-escape/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-03_docker-cp-copyout-destination-escape/Medium severity — cloud · None assigned as of 2026-07-03. Status: PoC. Affects: Docker Engine / CLI. Tags: docker, container-escape, toctou, symlink-race, docker-cp, path-traversal, archive-extraction, host-file-write.cloudMediumdockercontainer-escapetoctousymlink-racedocker-cppath-traversalarchive-extractionhost-file-writehttps://poc.intelseclab.com/pocs/binary/2026-06-26_cve-2026-50656-rogueplanet-checker/Fri, 26 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-26_cve-2026-50656-rogueplanet-checker/High severity (CVSS 7.8) — binary · CVE-2026-50656. Status: Researched. Affects: Microsoft Malware Protection Engine (mpengine.dll, MsMpEng.exe). Tags: LPE, Windows Defender, TOCTOU, symlink, reparse-point, junction, CWE-59, checker, detection, non-destructive, MsMpEng.binaryHighLPEWindows DefenderTOCTOUsymlinkreparse-pointjunctionCWE-59checkerdetectionnon-destructiveMsMpEnghttps://poc.intelseclab.com/pocs/binary/2026-06-10_rogueplanet-defender-lpe/Wed, 10 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-10_rogueplanet-defender-lpe/High severity (CVSS 7.8) — binary · CVE-2026-50656. Status: Weaponized. Affects: Microsoft Windows Defender / Windows Error Reporting Task Scheduler. Tags: LPE, Windows Defender, race-condition, TOCTOU, ISO-mount, VirtualDisk, Task-Scheduler, WER, EICAR, SYSTEM-shell, Windows-10, Windows-11, local.binaryHighLPEWindows Defenderrace-conditionTOCTOUISO-mountVirtualDiskTask-SchedulerWEREICARSYSTEM-shellWindows-10Windows-11localhttps://poc.intelseclab.com/pocs/web/2026-06-08_firefox-focus-ios-uxss-redirect-scheme-race-condition/Mon, 08 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-06-08_firefox-focus-ios-uxss-redirect-scheme-race-condition/Critical severity (CVSS 9.3) — web. Status: Unpatched. Affects: Firefox Focus for iOS. Tags: UXSS, XSS, race-condition, TOCTOU, redirect-validation, javascript-scheme, iOS, Firefox Focus.webCriticalUXSSXSSrace-conditionTOCTOUredirect-validationjavascript-schemeiOSFirefox Focushttps://poc.intelseclab.com/pocs/binary/2026-05-15_redsun-privileged-file-write/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_redsun-privileged-file-write/High severity (CVSS 7.8) — binary · CVE-2026-33825. Status: Weaponized. Affects: Microsoft Defender Antivirus (real-time protection) on Windows with Cloud Files APIs. Tags: LPE, privileged-file-write, Windows Defender, Cloud Files API, TOCTOU, file-reparse-point.binaryHighLPEprivileged-file-writeWindows DefenderCloud Files APITOCTOUfile-reparse-point