https://poc.intelseclab.com/tags/use-after-free/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-68398-ubuntu-pppol2tp-uaf-lpe/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-68398-ubuntu-pppol2tp-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2026-68398. Status: Patched. Affects: Linux Kernel (PPPoL2TP subsystem). Tags: linux, kernel, ubuntu, pppol2tp, l2tp, ppp, uaf, use-after-free, race-condition, lpe, privilege-escalation, kaslr-bypass, apparmor-bypass, suid, heap-spray, kmalloc-256, CVE-2026-68398.binaryHighlinuxkernelubuntupppol2tpl2tppppuafuse-after-freerace-conditionlpeprivilege-escalationkaslr-bypassapparmor-bypasssuidheap-spraykmalloc-256CVE-2026-68398https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-64564-sctphantom-sctp-asconf-uaf-lpe/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-64564-sctphantom-sctp-asconf-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2026-64564. Status: Patched. Affects: Linux kernel, SCTP (Stream Control Transmission Protocol) ASCONF subsystem. Tags: linux, kernel, lpe, sctp, use-after-free, asconf, del-ip, heap-spray, packet-tx-ring, kaslr-bypass, credential-overwrite, debian, CWE-416, CVE-2026-64564.binaryHighlinuxkernellpesctpuse-after-freeasconfdel-ipheap-spraypacket-tx-ringkaslr-bypasscredential-overwritedebianCWE-416CVE-2026-64564https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-68138-linux-qdisc-ratetable-race-lpe/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-68138-linux-qdisc-ratetable-race-lpe/High severity (CVSS 7.8) — binary · CVE-2026-68138. Status: Patched. Affects: Linux kernel, traffic-control qdisc rate-table subsystem (qdisc_get_rtab / qdisc_put_rtab). Tags: linux, kernel, lpe, race-condition, use-after-free, qdisc, traffic-control, flower, bpf, pipe, page-cache, modprobe, CWE-362, CWE-416, CVE-2026-68138.binaryHighlinuxkernellperace-conditionuse-after-freeqdisctraffic-controlflowerbpfpipepage-cachemodprobeCWE-362CWE-416CVE-2026-68138https://poc.intelseclab.com/pocs/binary/2026-08-09_cve-2026-64561-zapscape-kvm-shadow-mmu-guest-to-host/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-09_cve-2026-64561-zapscape-kvm-shadow-mmu-guest-to-host/High severity (CVSS 8.8) — binary · CVE-2026-64561. Status: Patched. Affects: Linux kernel, KVM/x86 shadow-MMU (nested EPT/NPT shadowing) — arch/x86/kvm/mmu/mmu.c and arch/x86/kvm/mmu/paging_tmpl.h. Tags: linux-kernel, kvm, x86, shadow-mmu, nested-virtualization, svm, npt, ept, guest-to-host-escape, vm-escape, use-after-free, CWE-416, cross-cache, kaslr-bypass, usermode-helper, virtualization.binaryHighlinux-kernelkvmx86shadow-mmunested-virtualizationsvmnpteptguest-to-host-escapevm-escapeuse-after-freeCWE-416cross-cachekaslr-bypassusermode-helpervirtualizationhttps://poc.intelseclab.com/pocs/binary/2026-08-09_mariadb-low-priv-rce-st-area-cursor-uaf/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-09_mariadb-low-priv-rce-st-area-cursor-uaf/Critical severity (CVSS 8.8) — binary · MDEV-40328 (ST_Area OOB read); cursor-array UAF has no assigned CVE yet. Status: Unpatched. Affects: MariaDB Server, ST_Area() geometry function and SYS_REFCURSOR cursor-array management. Tags: mariadb, database, rce, low-privilege, heap, oob-read, use-after-free, aslr-bypass, pie-bypass, coop, vtable, cursor, st-area, multipolygon, CWE-125, CWE-416, docker, v12-security.binaryCriticalmariadbdatabasercelow-privilegeheapoob-readuse-after-freeaslr-bypasspie-bypasscoopvtablecursorst-areamultipolygonCWE-125CWE-416dockerv12-securityhttps://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-46316-itscape-kvm-arm64-vgic-its-escape/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-46316-itscape-kvm-arm64-vgic-its-escape/Critical severity (CVSS 9.3) — binary · CVE-2026-46316 (GHSA-qcxh-2cm7-9fcc). Status: Weaponized. Affects: Linux kernel, KVM/arm64 in-kernel vGIC-ITS (Interrupt Translation Service) emulation (arch/arm64/kvm/vgic/vgic-its.c). Tags: linux-kernel, kvm, arm64, vgic-its, guest-to-host-escape, vm-escape, double-free, use-after-free, kaslr-bypass, heap-grooming, virtualization.binaryCriticallinux-kernelkvmarm64vgic-itsguest-to-host-escapevm-escapedouble-freeuse-after-freekaslr-bypassheap-groomingvirtualizationhttps://poc.intelseclab.com/pocs/binary/2026-07-08_cve-2026-43499-ghostlock-nebula-security/Wed, 08 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-08_cve-2026-43499-ghostlock-nebula-security/High severity (CVSS 7.8) — binary · CVE-2026-43499 (aka "GhostLock"). Status: Weaponized (per Nebula Security disclosure); no exploit code mirrored into this repo, see Notes. Affects: Linux kernel — rtmutex priority-inheritance (futex-PI) subsystem, CONFIG_FUTEX_PI. Tags: linux-kernel, use-after-free, futex, rtmutex, priority-inheritance, lpe, local, container-escape, kernelctf, ghostlock.binaryHighlinux-kerneluse-after-freefutexrtmutexpriority-inheritancelpelocalcontainer-escapekernelctfghostlockhttps://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-49844-redis-lua-uaf-jop-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-49844-redis-lua-uaf-jop-rce/Critical severity (CVSS 9.9) — binary · CVE-2025-49844. Status: Weaponized. Affects: Redis (embedded Lua scripting engine). Tags: redis, lua, use-after-free, uaf, memory-corruption, jop, jump-oriented-programming, shellcode, iced-x86, docker, cwe-416, rce.binaryCriticalredisluause-after-freeuafmemory-corruptionjopjump-oriented-programmingshellcodeiced-x86dockercwe-416rcehttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-42978-wpn-uaf-race/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-42978-wpn-uaf-race/High severity (CVSS 7.8) — binary · CVE-2026-42978. Status: PoC. Affects: Windows Push Notifications service (WpnService, wpncore.dll). Tags: windows, kernel, wpnservice, use-after-free, race-condition, toctou, privilege-escalation, etw, sysmon, patch-diffing.binaryHighwindowskernelwpnserviceuse-after-freerace-conditiontoctouprivilege-escalationetwsysmonpatch-diffinghttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43494-pintheft-nasm-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43494-pintheft-nasm-kernel-lpe/High severity — binary · CVE-2026-43494. Status: PoC. Affects: Linux kernel (RDS zerocopy send path + io_uring fixed buffers). Tags: linux-kernel, lpe, double-free, use-after-free, rds, io_uring, page-cache-overwrite, x86_64, nasm, asm, local, root-shell.binaryHighlinux-kernellpedouble-freeuse-after-freerdsio_uringpage-cache-overwritex86_64nasmasmlocalroot-shellhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40701-nginx-resolver-ocsp-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-40701-nginx-resolver-ocsp-uaf/Medium severity (CVSS 6.3) — web · CVE-2026-40701. Status: PoC. Affects: nginx (open source). Tags: nginx, use-after-free, ocsp-stapling, resolver, memory-corruption, docker-lab, tls.webMediumnginxuse-after-freeocsp-staplingresolvermemory-corruptiondocker-labtlshttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf/High severity (CVSS 7.8) — binary · CVE-2026-43499. Status: PoC. Affects: Linux kernel — kernel/locking/rtmutex.c, futex-PI subsystem (futex_requeue() / rt_mutex_start_proxy_lock()). Tags: linux-kernel, android, use-after-free, futex, rtmutex, priority-inheritance, lpe, local, kernel-panic, ndk.binaryHighlinux-kernelandroiduse-after-freefutexrtmutexpriority-inheritancelpelocalkernel-panicndkhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-3805-curl-smb-use-after-free/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-3805-curl-smb-use-after-free/High severity — network · CVE-2026-3805. Status: PoC. Affects: curl / libcurl. Tags: curl, libcurl, use-after-free, smb, cwe-416, memory-corruption, asan.networkHighcurllibcurluse-after-freesmbcwe-416memory-corruptionasanhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20637-applesepkeystore-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20637-applesepkeystore-uaf/High severity — binary · CVE-2026-20637. Status: PoC. Affects: AppleSEPKeyStore driver (com.apple.driver.AppleSEPKeyStore, exposed as IOKit service AppleKeyStore). Tags: ios, macos, kernel, iokit, use-after-free, race-condition, aksepkeystore, xnu, kernel-panic.binaryHighiosmacoskerneliokituse-after-freerace-conditionaksepkeystorexnukernel-panichttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43655-apple-m2-scalercscdriver-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43655-apple-m2-scalercscdriver-uaf/High severity — binary · CVE-2026-43655. Status: PoC. Affects: Apple AppleM2ScalerCSCDriver kext / IOSurfaceAcceleratorClient user-client (iOS, iPadOS, macOS on Apple M2-family scaler hardware). Tags: use-after-free, ios, ipados, macos, kernel, iokit, iosurface, kext, sandbox-escape-adjacent, memory-corruption.binaryHighuse-after-freeiosipadosmacoskerneliokitiosurfacekextsandbox-escape-adjacentmemory-corruptionhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20687-applejpegdriver-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20687-applejpegdriver-uaf/High severity — binary · CVE-2026-20687. Status: PoC. Affects: AppleJPEGDriver kernel extension. Tags: ios, kernel, applejpegdriver, use-after-free, mte, iokit, kernel-panic, camera.binaryHighioskernelapplejpegdriveruse-after-freemteiokitkernel-paniccamerahttps://poc.intelseclab.com/pocs/network/2026-07-03_redis-vector-set-hnsw-id-rce/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_redis-vector-set-hnsw-id-rce/Critical severity — network · None assigned as of 2026-07-03. Status: Weaponized. Affects: Redis server, Vector Set module (modules/vector-sets). Tags: redis, vector-set, hnsw, rce, deserialization, use-after-free, heap-corruption, rdb-restore.networkCriticalredisvector-sethnswrcedeserializationuse-after-freeheap-corruptionrdb-restorehttps://poc.intelseclab.com/pocs/network/2026-07-03_libssh2-publickey-list-parser-oob/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_libssh2-publickey-list-parser-oob/Critical severity — network · None assigned as of 2026-07-03. Status: Weaponized. Affects: libssh2, publickey subsystem list parser (src/publickey.c). Tags: libssh2, ssh, publickey-subsystem, heap-overflow, use-after-free, integer-overflow, windows, rce, memory-corruption.networkCriticallibssh2sshpublickey-subsystemheap-overflowuse-after-freeinteger-overflowwindowsrcememory-corruptionhttps://poc.intelseclab.com/pocs/web/2026-07-03_ladybird-wasm-esm-host-function-rce/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_ladybird-wasm-esm-host-function-rce/Critical severity — web · None assigned as of 2026-07-03. Status: Weaponized. Affects: Ladybird web browser (WebContent process, LibWeb / LibWasm). Tags: ladybird, browser, webassembly, wasm-gc, use-after-free, memory-corruption, rce, javascript-engine, sandbox-escape.webCriticalladybirdbrowserwebassemblywasm-gcuse-after-freememory-corruptionrcejavascript-enginesandbox-escapehttps://poc.intelseclab.com/pocs/network/2026-07-03_c-ares-tcp-getaddrinfo-uaf/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_c-ares-tcp-getaddrinfo-uaf/High severity — network · None assigned as of 2026-07-03. Status: PoC. Affects: c-ares (async DNS resolver library). Tags: c-ares, use-after-free, dns, resolver, tcp, heap-corruption, code-execution, edns.networkHighc-aresuse-after-freednsresolvertcpheap-corruptioncode-executionednshttps://poc.intelseclab.com/pocs/binary/2026-05-20_pintheft-rds-double-free/Wed, 20 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-20_pintheft-rds-double-free/High severity — binary. Status: Weaponized. Affects: Linux kernel (RDS subsystem + io_uring). Tags: LPE, double-free, use-after-free, Linux kernel, RDS, io_uring, page-cache-overwrite, x86_64, local.binaryHighLPEdouble-freeuse-after-freeLinux kernelRDSio_uringpage-cache-overwritex86_64localhttps://poc.intelseclab.com/pocs/web/2026-05-18_chrome-webgpu-use-after-free/Mon, 18 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-18_chrome-webgpu-use-after-free/High severity (CVSS 8.8) — web · CVE-2026-5281. Status: Weaponized. Affects: Google Chrome / Chromium WebGPU (Dawn backend). Tags: use-after-free, WebGPU, Chrome, Dawn, GPU, browser, unauthenticated.webHighuse-after-freeWebGPUChromeDawnGPUbrowserunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-05-16_chrome-cssfontfeaturevaluesmap-use-after-free/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-16_chrome-cssfontfeaturevaluesmap-use-after-free/High severity (CVSS 8.8) — web · CVE-2026-2441. Status: Weaponized. Affects: Google Chrome / Chromium-based browsers (Blink CSS engine). Tags: use-after-free, Chrome, Blink, CSSOM, renderer-rce, unauthenticated, drive-by.webHighuse-after-freeChromeBlinkCSSOMrenderer-rceunauthenticateddrive-byhttps://poc.intelseclab.com/pocs/network/2026-05-15_cve-2021-31166-http-sys-uaf/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-15_cve-2021-31166-http-sys-uaf/Critical severity (CVSS 9.8) — network · CVE-2021-31166. Status: Weaponized. Affects: Microsoft Windows HTTP Protocol Stack (http.sys). Tags: HTTP.sys, use-after-free, RCE, Windows, kernel, unauthenticated.networkCriticalHTTP.sysuse-after-freeRCEWindowskernelunauthenticated