Unprivileged — PoC Archivehttps://poc.intelseclab.com/tags/unprivileged/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Windows CLFS.sys Unrecoverable State / BSoD via ReadFile on Log File Handle (CVE-2026-2636)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-2636-clfs-sys-bsod/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-2636-clfs-sys-bsod/Medium severity — binary · CVE-2026-2636. Status: PoC. Affects: Windows Common Log File System driver (CLFS.sys, version 10.0.22621.5037 used as reference). Tags: clfs, windows-kernel-driver, bsod, denial-of-service, cwe-159, irp, kebugcheckex, unprivileged.binaryMediumclfswindows-kernel-driverbsoddenial-of-servicecwe-159irpkebugcheckexunprivilegedLinux Kernel mm/mseal VMA-Merge Stale-Bound Bug (CVE-2026-23416)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-23416-linux-kernel-mseal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-23416-linux-kernel-mseal/Medium severity — binary · CVE-2026-23416. Status: PoC. Affects: Linux kernel, mm/mseal.c / mm/vma.c (mseal_apply() / vma_merge_existing_range()). Tags: linux-kernel, mseal, mm-subsystem, vma, logic-error, unprivileged, security-feature-bypass, memfd.binaryMediumlinux-kernelmsealmm-subsystemvmalogic-errorunprivilegedsecurity-feature-bypassmemfdLinux FUSE Readdir Cache Out-of-Bounds Write to Root LPE — CVE-2026-31694https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31694-fuse-readdir-cache-oob/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31694-fuse-readdir-cache-oob/High severity — binary · CVE-2026-31694. Status: Weaponized. Affects: Linux kernel — fs/fuse/readdir.c (fuse_add_dirent_to_cache()). Tags: linux-kernel, fuse, oob-write, page-cache, lpe, groom, unprivileged, qemu-kvm.binaryHighlinux-kernelfuseoob-writepage-cachelpegroomunprivilegedqemu-kvmDirtyDecrypt-Go — RxRPC rxgk Page-Cache Overwrite LPE (Go Port) — CVE-2026-31635https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31635-dirtydecrypt-go-rxgk-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31635-dirtydecrypt-go-rxgk-lpe/High severity — binary · CVE-2026-31635. Status: Weaponized. Affects: Linux kernel — net/rxrpc/rxgk_common.h (rxgk_decrypt_skb()). Tags: linux-kernel, lpe, rxrpc, rxgk, page-cache, dirty-pipe-variant, splice, golang, unprivileged.binaryHighlinux-kernellperxrpcrxgkpage-cachedirty-pipe-variantsplicegolangunprivilegedDirtyDecrypt / DirtyCBC — rxgk Page-Cache Write (Dirty Pipe Variant)https://poc.intelseclab.com/pocs/binary/2026-05-18_dirtydecrypt/Mon, 18 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-18_dirtydecrypt/High severity — binary · N/A (reported as duplicate by kernel maintainers; patched on mainline). Status: Weaponized. Affects: Linux kernel — net/rxrpc (rxgk_decrypt_skb). Tags: LPE, Linux kernel, page-cache, rxgk, RxRPC, COW, write-primitive, unprivileged, Dirty-Pipe-variant, splice, MSG_SPLICE_PAGES.binaryHighLPELinux kernelpage-cacherxgkRxRPCCOWwrite-primitiveunprivilegedDirty-Pipe-variantspliceMSG_SPLICE_PAGESLinux XFRM ESP-in-TCP Local Privilege Escalation (Fragnesia)https://poc.intelseclab.com/pocs/binary/2026-05-14_linux-xfrm-fragnesia-lpe/Thu, 14 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-14_linux-xfrm-fragnesia-lpe/High severity (CVSS 7.8) — binary · CVE-2026-46300. Status: Weaponized. Affects: Linux kernel (XFRM ESP-in-TCP subsystem). Tags: LPE, privilege-escalation, kernel, XFRM, ESP-in-TCP, page-cache, write-primitive, unprivileged.binaryHighLPEprivilege-escalationkernelXFRMESP-in-TCPpage-cachewrite-primitiveunprivileged