tag
Windows
Windows Media Player DLL Hijack -- Local Privilege Escalation (CVE-2026-21508)
CVE-2026-21508 is a DLL hijacking vulnerability that achieves Session 0 privilege escalation on Windows 11. WUDFHost.exe loads CrossDevice.Streaming.Source.dll from the user-writable path C:\ProgramData\CrossDevice\. By planting a malicious DLL and…
Microsoft SCCM — AdminService CAB Extraction Path-Traversal to SYSTEM RCE (CVE-2026-47301)
CVE-2026-47301 is a remote code execution vulnerability in Microsoft Configuration Manager (SCCM) that chains four weaknesses: broken access control on the AdminService UploadExtensionInChunks endpoint (any domain user, no RBAC check), CAB extraction…
Windows Kerberos — ResetNightmare: Arbitrary Password Reset via Change Password Protocol Validation Flaw (CVE-2026-27912)
CVE-2026-27912, nicknamed ResetNightmare by Semperis, is a validation flaw in the Kerberos Change Password protocol that allows an attacker to reset the password of any user or computer account in Active Directory — including Domain Admins, the krbtgt…
Windows Defender — ShieldBreak: RoguePlanet (CVE-2026-50656) Patch Bypass via Cloud Files Rehydration + Object Manager Symlinks
ShieldBreak is a 0-day local privilege escalation exploit that bypasses the patch for CVE-2026-50656 (RoguePlanet), achieving SYSTEM-level code execution from an unprivileged user on fully patched Windows 11 and Server 2025 systems. The exploit was released…
Active Directory — SPN Unicode Collision Detection Scanner (CVE-2026-25177)
CVE-2026-25177 is a privilege escalation vulnerability in Active Directory Domain Services caused by improper restriction of Unicode characters in Service Principal Names (SPNs). An authenticated user with write-SPN permissions can inject Unicode zero-width…
Barrier 2.4.0 — barrierd.exe Unauthenticated IPC → SYSTEM Privilege Escalation (NotCVE-2026-0010)
Barrier 2.4.0 ships a Windows service daemon (barrierd.exe) that runs as LocalSystem and binds a TCP IPC control server on 127.0.0.1:24801 with no authentication. Any local process, regardless of privilege level, can connect to that port and send a…
Windows WalletService Known-Folder Redirection → ESE Persisted-Callback DLL Load Local Privilege Escalation (CVE-2026-49176)
Windows WalletService — which runs as LocalSystem — resolves the caller's FOLDERIDDocuments known folder while impersonating the calling user, then reverts to the LocalSystem token before opening <Documents>\Wallet\wallet.db. Because the folder resolution…
Windows Message Queuing (MSMQ) Queue Manager Heap-Based Buffer Overflow (CVE-2026-54992)
MSMQ's Queue Manager processes RStartReceive/RStartTransactionalReceive responses from the MS-MQRR RPC interface as a set of SectionBuffer structures, each carrying its own SectionSizeAlloc. When a remote-read response is split into multiple sections,…
GreatXML — WinRE / Defender Offline-Scan Trust-Boundary Abuse → BitLocker Bypass (No CVE)
GreatXML abuses the trust boundary around Microsoft Defender's Offline Scan feature, which reboots a Windows machine into WinRE (Windows PE) and runs OfflineScannerShell.exe with elevated, pre-BitLocker-unlock trust. The ReAgent.xml recovery-configuration…
AD CS/AD FS Enrollment "cdc" Chase Attribute Abuse → Domain Controller Impersonation (CertiGhost, CVE-2026-54121)
CertiGhost (CVE-2026-54121) abuses a "chase" mechanism in AD CS certificate enrollment: when a certificate request carries a cdc (chase domain controller) attribute pointing at an attacker-controlled IP alongside an rmd (remote machine DNS) attribute naming a…
LegacyHive - Windows user profile service arbitrary hive load elevation of privileges vulnerability
LegacyHive demonstrates a local privilege-escalation path in Windows user profile hive handling where a low-privileged user can influence how another user's hive is loaded. The PoC modifies hive data and abuses object manager links and an oplock timing window…
React Native Community CLI Metro Dev Server `/open-url` OS Command Injection (CVE-2025-11953)
The Metro Development Server started by the React Native Community CLI binds to external network interfaces by default and exposes an /open-url HTTP endpoint (implemented by openURLMiddleware in @react-native-community/cli-server-api) that is intended to open…
XIGNCODE3 Anti-Cheat Driver PPL-Bypass LSASS Credential Dump (CVE-2026-3609)
Wellbia's XIGNCODE3 anti-cheat kernel driver xhunter1.sys exposes an IRPMJWRITE command interface that calls ObOpenObjectByPointer with AccessMode = KernelMode and without the OBJKERNELHANDLE flag, handing a kernel-minted PROCESSALLACCESS handle straight into…
Windows ShellLink (.lnk) Remote Code Execution — CVE-2026-21510 LNK-Stomping Generator
This is a standalone Python generator (lnkstomperpoint.py) that builds malicious Windows .lnk shortcut files exploiting CVE-2026-21510, a ShellLink remote-code-execution issue in how Windows resolves and launches shortcut targets. The tool assembles a…
Windows Shell LNK _IDCONTROLW Zero-Click SMB Coercion Builder — CVE-2026-32202
This repository documents a reverse-engineered, undocumented IDCONTROLW structure used internally by shell32.dll to represent Control Panel applet items inside a .lnk file's LinkTargetIDList, based on the researcher's own IDA Pro static analysis and…
Windows Push Notification Service Use-After-Free Race (CVE-2026-42978)
CVE-2026-42978 is a use-after-free race condition (CWE-362) in wpncore.dll's PresentationEndpointFacade class, which backs the WpnService Windows Push Notification service running as NT AUTHORITY\SYSTEM. Facade methods (e.g. ToastUnblockAll) fetch a pointer…
Windows Kernel Local Privilege Escalation via SeDebugPrivilege Bit Corruption (CVE-2026-40369)
This exploit is a local privilege escalation chain against the Windows kernel that abuses a low-level primitive reachable through NtQuerySystemInformation to corrupt a bit near the process's SeDebugPrivilege state in kernel memory, without requiring the…
Windows HTTP.sys Header-Count-Triggered Kernel Memory Corruption / BSOD (CVE-2026-49160)
This PoC targets a memory-safety bug in the Windows HTTP.sys kernel driver's request header parsing path (HTTP!UlpParseNextRequest / HTTP!UlpHandleRequest). The included http2bomb.py script establishes a TLS/HTTP2 connection to a target IIS/HTTP.sys-backed…
Windows Error Reporting Service ALPC Local Privilege Escalation (CVE-2026-20817)
CVE-2026-20817 abuses an ALPC-based elevation primitive in the Windows Error Reporting Service. WerSvc listens on the \WindowsErrorReportingServicePort ALPC port and, upon receiving a specially crafted WERSVCMSG request with the SvcElevatedLaunch message flag…
Notepad++ nativeLang.xml Format String Crash / Info Disclosure — CVE-2026-3008
Notepad++'s Find Results panel initializer (sub1400916C0) retrieves the localized find-result-hits string from nativeLang.xml and passes it directly as the format string argument to wsprintfW, with no accompanying variadic data arguments and no validation of…
MiniTool pwdrvio.sys Kernel Write-What-Where — Local Privilege Escalation Primitive (CVE-2026-36981)
MiniTool's pwdrvio.sys kernel driver exposes a write-what-where condition through its IOCTL interface, allowing an unprivileged local attacker to write attacker-controlled data to an attacker-controlled kernel address. The included PoC demonstrates a…
MiniTool pwdrvio.sys Kernel Driver Buffer Overflow — Local DoS/BSOD (CVE-2026-36980)
MiniTool's pwdrvio.sys kernel driver contains a buffer overflow in its IOCTL handler. An unprivileged local attacker can send a crafted IOCTL request that corrupts kernel pool memory, triggering an immediate system crash (BSOD) — a local denial-of-service…
Microsoft Defender Link Following Local Privilege Escalation (CVE-2026-41091)
CVE-2026-41091 is a local privilege escalation vulnerability in Microsoft Defender caused by improper link resolution (CWE-59) during file operations performed with SYSTEM privileges. By racing a Defender-triggered scan against filesystem oplocks, and then…
Lenovo LDE (LdeApi.Server.exe) Unimpersonated Junction-Based Arbitrary File Write to SYSTEM (CVE-2026-0827)
The Lenovo LDE service process LdeApi.Server.exe runs as SYSTEM and periodically writes a file named MP27AM7Westimation.json into C:\ProgramData\Lenovo\LDE\SYSTEM without impersonating the calling user and without verifying the target path is a real directory…
KillChain — Vulnerable Kernel Driver IOCTL Protected-Process Termination (CVE-2026-0828)
KillChain is a fully-built "Bring Your Own Vulnerable Driver" (BYOVD) tool that embeds a vulnerable kernel driver, ProcessMonitorDriver.sys, directly inside its executable as a raw byte array. At runtime it extracts the driver to a temp path, registers it as…
Discord Desktop Client Uncontrolled Search Path Element / Local Code Execution (CVE-2026-0776)
CVE-2026-0776 is an Uncontrolled Search Path Element (CWE-427) issue in the Discord Desktop Client on Windows: under certain conditions the Electron/Node.js runtime resolves and loads native/JS modules from a filesystem location that a local, unprivileged…
Balena Etcher Windows TOCTOU Privilege Escalation — CVE-2026-30332
Balena Etcher for Windows writes a temporary .cmd script (containing environment variables and the command to launch etcher-util.exe) to a user-writable temp directory and then executes it with elevated privileges via a UAC prompt. Because there is a time gap…
ASUS DriverHub Update TOCTOU Local Privilege Escalation — CVE-2026-1880
ASUS DriverHub updates drivers by downloading a package, extracting it to C:\ProgramData\ASUS\AsusDriverHub\SupportTemp\<drivername>, and later launching setup.exe from that directory via ShellExecuteExW. Because the driver folder name can be predicted from…
Apache Solr UNC Path Validation Bypass to RCE (CVE-2026-22444)
CVE-2026-22444 affects Apache Solr's "create core" admin API on Windows deployments running in standalone mode. Path validation (assertPathAllowed()) is only performed after the CoreDescriptor constructor has already triggered filesystem/network operations…
Amazon WorkSpaces Skylight Workspace Config Service Local Privilege Escalation (CVE-2026-7791)
The Skylight Workspace Config Service on Amazon WorkSpaces runs as SYSTEM and performs scheduled log rotation under C:\ProgramData\Amazon. Permissive ACLs on this directory, a ROTATE directory junction, absence of file-type checks, and a ~1-10 ms TOCTOU…
VLC Bundled FFmpeg VP9 Decoder Resolution-Change Heap Crash
VLC 3.0.23's bundled FFmpeg VP9 decoder tracks per-frame slice-thread progress in an entries array sized from the superblock row count (sbrows) of the current frame. A crafted two-frame VP9 IVF file — a 64x64 first frame followed by a 64x8192 second frame…
System Informer phsvc Trusted-Host Confused Deputy LPE
System Informer's privileged helper process phsvc exposes an ALPC API port (\BaseNamedObjects\SiSvcApiPort) with a connect ACL open to Everyone, and authorizes connecting clients purely by checking whether the client's process image is generically…
OpenVPN Connect Server-Pushed Option Current-User Command Execution
A malicious OpenVPN server can push an echo option to a connected OpenVPN Connect for Windows client that decodes into the internal script.win.user.disconnect script key. OpenVPN Connect then executes that pushed command when the client disconnects, even…
libssh2 Publickey Subsystem List Parser Heap Corruption to Code Execution
libssh2publickeylistfetch() parses a stream of publickey-subsystem response packets and grows an array of libssh2publickeylist entries as responses arrive, but the parser has two distinct memory-safety defects depending on target architecture. On 32-bit…
ImageMagick Ghostscript Delegate Search Path Hijack
When ImageMagick converts PDF/PS/EPS-family inputs on Windows and cannot resolve a full path to Ghostscript, it falls back to invoking the bare executable name gswin64c.exe and launches it through the Windows process API with the application name left unset —…
Flowise Custom MCP Environment Variable Case Bypass
Flowise's Custom MCP stdio node validates configured environment variables against a denylist (PATH, LDLIBRARYPATH, DYLDLIBRARYPATH, NODEOPTIONS) using exact, case-sensitive string comparison. Windows, however, treats environment variable names…
AnyDesk Printer Pipe COM Impersonation Local Privilege Escalation
AnyDesk's local printer IPC worker creates a named pipe (\\.\pipe\adprinterpipe) with an ACL that grants access to Everyone, then accepts a message containing attacker-controlled COM marshaling bytes, unmarshals it into an IUnknown, queries for IStream, and…
7-Zip RAR5 Mark-of-the-Web / ADS Full-Chain Bypass
7-Zip 26.01 on Windows mishandles RAR5 archives that contain crafted STM (stream) service records alongside a normal file entry. By naming one stream ::$DATA and another :Zone.Identifier:$DATA, an attacker can make the archive-provided data silently override…
Windows CTFMON Arbitrary Section Object EoP — GreenPlasma (CVE-2026-45586)
CVE-2026-45586 (GreenPlasma) is a Windows CTFMON Elevation of Privilege vulnerability exploiting an arbitrary named section object creation primitive. A standard unprivileged user can create a section object in any directory object writable by SYSTEM, abusing…
Notepad++ <= 8.9.6 Multiple Vulnerabilities (CVE-2026-48770, CVE-2026-48778, CVE-2026-48800)
This PoC set covers three Notepad++ vulnerabilities affecting versions up to 8.9.6. CVE-2026-48770 demonstrates an out-of-bounds read crash by sending malformed WMCOPYDATA data to a running Notepad++ process. CVE-2026-48778 and CVE-2026-48800 demonstrate…
Windows NTLM Hash Disclosure via File Explorer - CVE-2025-24054
CVE-2025-24054 is a zero-click NTLMv2-SSP hash disclosure vulnerability in Windows File Explorer. When a user opens a ZIP archive containing a crafted .searchConnector-ms file, Windows Explorer automatically resolves an embedded UNC path during file preview,…
Windows MMC MSC EvilTwin - CVE-2025-26633
CVE-2025-26633 is a zero-day vulnerability in Microsoft Management Console (MMC) that was exploited in the wild by Russian APT group Water Gamayun (EncryptHub/Larva-208). An attacker crafts a malicious .msc file that abuses the MUIPath resolution mechanism:…
ToolShell - SharePoint Unauthenticated RCE Chain
CVE-2025-53770 ("ToolShell") is a full unauthenticated remote code execution chain against Microsoft SharePoint Server. The chain combines an authentication bypass in the ToolPane.aspx endpoint (CVE-2025-49706 / patch bypass CVE-2025-53771) with an unsafe…
Windows OLE Zero-Click RCE via Outlook RTF (CVE-2025-21298)
CVE-2025-21298 is a critical Windows OLE memory-corruption vulnerability in ole32.dll that can be triggered through malicious RTF content. In Outlook scenarios, preview-pane rendering is sufficient to trigger the vulnerable parsing flow, making this…
Adobe Acrobat/Reader Prototype Pollution Sandbox Escape (CVE-2026-34621)
This repository contains a Python-based exploit generator for CVE-2026-34621, described as a prototype pollution vulnerability in Adobe Acrobat and Reader that can break JavaScript trust boundaries. The generated PDF embeds JavaScript intended to escalate…
WinRAR Archive Extraction Path Traversal (CVE-2025-6218)
This PoC demonstrates CVE-2025-6218 in WinRAR, where a crafted archive extraction path can place files outside the intended destination directory. The provided batch script builds a ZIP archive that writes a .bat file into the current user's Startup folder.…
MiniPlasma - Windows Cloud Files Mini Filter Driver LPE (CVE-2020-17103)
MiniPlasma is a fully weaponized Windows LPE that exploits a race condition in cldflrt!HsmOsBlockPlaceholderAccess inside cldflt.sys — the same vulnerability originally discovered by James Forshaw (Google Project Zero) and reported as CVE-2020-17103 in 2020.…
HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2021-31166)
CVE-2021-31166 is a remote use-after-free vulnerability in the Windows HTTP Protocol Stack (http.sys) that is reachable via crafted HTTP headers. The public PoC sends a malformed Accept-Encoding header to trigger unsafe list handling in the kernel HTTP parser…
CVE-2024-21338 — Local Privilege Escalation from Admin to Kernel
This PoC targets CVE-2024-21338, a Windows local privilege-escalation issue that enables escalation from local administrator context toward kernel-level control. The exploit chain performs token impersonation and then abuses an AppLocker IOCTL handler with…