Windows-11 — PoC Archivehttps://poc.intelseclab.com/tags/windows-11/Latest proof-of-concept entries.Hugoen-usSun, 28 Jun 2026 00:00:00 +0000Windows CTFMON Arbitrary Section Object EoP — GreenPlasma (CVE-2026-45586)https://poc.intelseclab.com/pocs/binary/2026-06-28_cve-2026-45586-ctfmon-greenplasma-lpe/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-28_cve-2026-45586-ctfmon-greenplasma-lpe/High severity (CVSS 7.8) — binary · CVE-2026-45586. Status: PoC. Affects: Windows Collaborative Translation Framework (CTFMON service). Tags: LPE, EoP, Windows, CTFMON, section-object, object-directory, link-following, zero-day, CTF-challenge, Windows-11, Windows-2022, Windows-2026, incomplete-poc.binaryHighLPEEoPWindowsCTFMONsection-objectobject-directorylink-followingzero-dayCTF-challengeWindows-11Windows-2022Windows-2026incomplete-pocYellowKey — BitLocker Bypass via WinRE autofstx.exe (CVE-2026-45585)https://poc.intelseclab.com/pocs/misc/2026-06-26_yellowkey-bitlocker-bypass/Fri, 26 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-06-26_yellowkey-bitlocker-bypass/Medium severity (CVSS 6.1) — misc · CVE-2026-45585. Status: Researched. Affects: Windows BitLocker / WinRE (autofstx.exe). Tags: BitLocker, bypass, physical-access, WinRE, TPM, autofstx, NTFS-transactions, FsTx, Windows-11, Windows-Server-2022, zero-day, full-disk-access.miscMediumBitLockerbypassphysical-accessWinRETPMautofstxNTFS-transactionsFsTxWindows-11Windows-Server-2022zero-dayfull-disk-accessRoguePlanet — Windows Defender LPE via ISO Mount + Task Scheduler Race Conditionhttps://poc.intelseclab.com/pocs/binary/2026-06-10_rogueplanet-defender-lpe/Wed, 10 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-10_rogueplanet-defender-lpe/High severity (CVSS 7.8) — binary · CVE-2026-50656. Status: Weaponized. Affects: Microsoft Windows Defender / Windows Error Reporting Task Scheduler. Tags: LPE, Windows Defender, race-condition, TOCTOU, ISO-mount, VirtualDisk, Task-Scheduler, WER, EICAR, SYSTEM-shell, Windows-10, Windows-11, local.binaryHighLPEWindows Defenderrace-conditionTOCTOUISO-mountVirtualDiskTask-SchedulerWEREICARSYSTEM-shellWindows-10Windows-11localWindows Kernel Elevation of Privilege - Race Condition / Double-Free (CVE-2025-62215)https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-kernel-eop-cve-2025-62215/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-kernel-eop-cve-2025-62215/High severity (CVSS 7) — binary · CVE-2025-62215. Status: Weaponized. Affects: Windows Kernel (ntoskrnl.exe / kernel resource synchronization). Tags: EoP, Windows kernel, race condition, double-free, heap corruption, 0day, SYSTEM, Windows 10, Windows 11.binaryHighEoPWindows kernelrace conditiondouble-freeheap corruption0daySYSTEMWindows 10Windows 11