https://poc.intelseclab.com/tags/windows/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-21508-windows-mediaplayer-dll-hijack-lpe/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-21508-windows-mediaplayer-dll-hijack-lpe/High severity (CVSS 7.8) — binary · CVE-2026-21508. Status: Patched. Affects: Microsoft Windows Media Player / WUDFHost.exe. Tags: windows, dll-hijack, lpe, privilege-escalation, media-player, wudfhost, session0, com-hijack, CVE-2026-21508.binaryHighwindowsdll-hijacklpeprivilege-escalationmedia-playerwudfhostsession0com-hijackCVE-2026-21508https://poc.intelseclab.com/pocs/network/2026-08-15_cve-2026-47301-sccm-adminservice-cab-rce/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-15_cve-2026-47301-sccm-adminservice-cab-rce/Critical severity (CVSS 9.8) — network · CVE-2026-47301. Status: Patched. Affects: Microsoft Configuration Manager (SCCM / ConfigMgr), AdminService REST API. Tags: windows, sccm, configmgr, rce, cab, path-traversal, dll-hijacking, dll-proxy, arbitrary-file-write, system, microsoft, CVE-2026-47301.networkCriticalwindowssccmconfigmgrrcecabpath-traversaldll-hijackingdll-proxyarbitrary-file-writesystemmicrosoftCVE-2026-47301https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-27912-resetnightmare-kerberos-changepw-password-reset/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-27912-resetnightmare-kerberos-changepw-password-reset/High severity (CVSS 8) — network · CVE-2026-27912. Status: Patched. Affects: Microsoft Windows Kerberos Key Distribution Center (KDC), Change Password protocol (kadmin/changepw). Tags: windows, kerberos, active-directory, privilege-escalation, password-reset, domain-controller, upn, rubeus, changepw, krbtgt, CWE-285, microsoft, CVE-2026-27912.networkHighwindowskerberosactive-directoryprivilege-escalationpassword-resetdomain-controllerupnrubeuschangepwkrbtgtCWE-285microsoftCVE-2026-27912https://poc.intelseclab.com/pocs/binary/2026-08-11_shieldbreak-defender-rogueplanet-patch-bypass/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-11_shieldbreak-defender-rogueplanet-patch-bypass/High severity (CVSS 7.8) — binary · Bypass of CVE-2026-50656 (RoguePlanet); no CVE assigned to ShieldBreak as of 2026-08-11. Status: Unpatched. Affects: Microsoft Windows Defender (Antimalware Service Executable / MsMpEng.exe), threat remediation subsystem. Tags: windows, windows-defender, lpe, privilege-escalation, 0day, patch-bypass, cloud-files, cfapi, object-manager, symlink, wer, dll-sideload, CWE-59, CWE-426, microsoft, rogueplanet, shieldbreak.binaryHighwindowswindows-defenderlpeprivilege-escalation0daypatch-bypasscloud-filescfapiobject-managersymlinkwerdll-sideloadCWE-59CWE-426microsoftrogueplanetshieldbreakhttps://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-25177-ad-spn-unicode-collision-detector/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-11_cve-2026-25177-ad-spn-unicode-collision-detector/High severity (CVSS 8.8) — network · CVE-2026-25177. Status: Patched. Affects: Microsoft Active Directory Domain Services, Service Principal Name (SPN) validation. Tags: windows, active-directory, kerberos, spn, unicode, homoglyph, privilege-escalation, detection, scanner, ldap, CWE-641, microsoft, CVE-2026-25177.networkHighwindowsactive-directorykerberosspnunicodehomoglyphprivilege-escalationdetectionscannerldapCWE-641microsoftCVE-2026-25177https://poc.intelseclab.com/pocs/binary/2026-08-01_notcve-2026-0010-barrier-daemon-lpe/Sat, 01 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-01_notcve-2026-0010-barrier-daemon-lpe/High severity — binary · NotCVE-2026-0010 (disputed CVE assignment — author contests the identifier). Status: Unpatched — Barrier is unmaintained with no vendor fix; patched successor Deskflow covers the same issue via CVE-2026-41477 / GHSA-6rx5-g478-775c. Affects: Barrier (debauchee), Windows service daemon barrierd.exe. Tags: barrier, barrierd, windows, ipc, tcp-24801, unauthenticated, lpe, privilege-escalation, system, cwe-306, local.binaryHighbarrierbarrierdwindowsipctcp-24801unauthenticatedlpeprivilege-escalationsystemcwe-306localhttps://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-49176-windows-walletservice-lpe/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-49176-windows-walletservice-lpe/High severity (CVSS 7.8) — binary · CVE-2026-49176. Status: Weaponized — SYSTEM shell confirmed against a real, vulnerable Windows 11 build. Affects: Windows WalletService (Windows.ApplicationModel.Wallet WinRT API, backed by an ESE/Jet Blue database under the caller's Documents\Wallet folder). Tags: windows, walletservice, lpe, privilege-escalation, ese, extensible-storage-engine, known-folder-redirection, persisted-callback, local.binaryHighwindowswalletservicelpeprivilege-escalationeseextensible-storage-engineknown-folder-redirectionpersisted-callbacklocalhttps://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54992-windows-msmq-heap-overflow/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54992-windows-msmq-heap-overflow/High severity (CVSS 8.4) — network · CVE-2026-54992. Status: PoC (crash/DoS confirmed, no RCE demonstrated). Affects: Windows Message Queuing (MSMQ) — Queue Manager (mqqm.dll, hosted in mqsvc.exe), reached via the MS-MQRR (RemoteRead) RPC interface. Tags: windows, msmq, message-queuing, heap-overflow, integer-overflow, rpc, dos, crash.networkHighwindowsmsmqmessage-queuingheap-overflowinteger-overflowrpcdoscrashhttps://poc.intelseclab.com/pocs/binary/2026-07-27_greatxml-winre-bitlocker-bypass/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_greatxml-winre-bitlocker-bypass/High severity — binary · N/A (no CVE assigned, no Microsoft advisory as of 2026-07-27). Status: Unpatched. Affects: Windows Recovery Environment (WinRE) — Microsoft Defender Offline Scan launch path (ReAgent.xml scheduled operation). Tags: windows, bitlocker, winre, defender, offline-scan, trust-boundary-bypass, zero-day, unpatched, physical-access, local.binaryHighwindowsbitlockerwinredefenderoffline-scantrust-boundary-bypasszero-dayunpatchedphysical-accesslocalhttps://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54121-certighost-adcs-dc-impersonation/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-27_cve-2026-54121-certighost-adcs-dc-impersonation/High severity (CVSS 8.8) — network · CVE-2026-54121. Status: Weaponized. Affects: Microsoft Active Directory Certificate Services (AD CS) Enterprise CA, in environments where AD FS / certificate enrollment resolves DC identity via "chase" (cdc/rmd) request attributes. Tags: active-directory, adcs, certificate-services, dcsync, pkinit, kerberos, privilege-escalation, domain-controller-impersonation, windows.networkHighactive-directoryadcscertificate-servicesdcsyncpkinitkerberosprivilege-escalationdomain-controller-impersonationwindowshttps://poc.intelseclab.com/pocs/binary/2026-07-19_legacyhive-user-profile-service-hive-load-lpe/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-19_legacyhive-user-profile-service-hive-load-lpe/High severity — binary. Status: Weaponized. Affects: Microsoft Windows user profile service / registry hive loading path. Tags: windows, lpe, user-profile-service, registry-hive, usrclass.dat, oplock, symbolic-link.binaryHighwindowslpeuser-profile-serviceregistry-hiveusrclass.datoplocksymbolic-linkhttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-11953-react-native-metro-command-injection/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-11953-react-native-metro-command-injection/Critical severity (CVSS 9.8) — network · CVE-2025-11953. Status: Weaponized. Affects: @react-native-community/cli / @react-native-community/cli-server-api (Metro Development Server, openURLMiddleware). Tags: react-native, metro, dev-server, cli-server-api, open-url, command-injection, cwe-78, unauthenticated, node.js, python, windows, cross-platform.networkCriticalreact-nativemetrodev-servercli-server-apiopen-urlcommand-injectioncwe-78unauthenticatednode.jspythonwindowscross-platformhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3609-xigncode3-lsass-credential-dump/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3609-xigncode3-lsass-credential-dump/High severity — binary · CVE-2026-3609. Status: Weaponized. Affects: Wellbia XIGNCODE3 anti-cheat driver (xhunter1.sys). Tags: lsass, credential-dumping, anti-cheat, kernel-driver, ppl-bypass, xigncode3, windows, byovd.binaryHighlsasscredential-dumpinganti-cheatkernel-driverppl-bypassxigncode3windowsbyovdhttps://poc.intelseclab.com/pocs/social-engineering/2026-07-05_cve-2026-21510-lnk-stomping-generator/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/social-engineering/2026-07-05_cve-2026-21510-lnk-stomping-generator/High severity — social-engineering · CVE-2026-21510. Status: Weaponized. Affects: Windows Shell Link (.lnk) parsing (MS-SHLLINK). Tags: lnk-stomping, shelllink, cve-2026-21510, windows, initial-access, phishing, anti-forensics, red-team.social-engineeringHighlnk-stompingshelllinkcve-2026-21510windowsinitial-accessphishinganti-forensicsred-teamhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-32202-lnk-idcontrolw-builder/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-32202-lnk-idcontrolw-builder/High severity — binary · CVE-2026-32202 (related: CVE-2026-21510). Status: PoC. Affects: Windows Shell (shell32.dll) / Windows Explorer. Tags: lnk, shell32, windows, apt28, smb-coercion, zero-click, reverse-engineering, control-panel.binaryHighlnkshell32windowsapt28smb-coercionzero-clickreverse-engineeringcontrol-panelhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-42978-wpn-uaf-race/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-42978-wpn-uaf-race/High severity (CVSS 7.8) — binary · CVE-2026-42978. Status: PoC. Affects: Windows Push Notifications service (WpnService, wpncore.dll). Tags: windows, kernel, wpnservice, use-after-free, race-condition, toctou, privilege-escalation, etw, sysmon, patch-diffing.binaryHighwindowskernelwpnserviceuse-after-freerace-conditiontoctouprivilege-escalationetwsysmonpatch-diffinghttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-40369-windows-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-40369-windows-kernel-lpe/High severity — binary · CVE-2026-40369. Status: PoC. Affects: Windows kernel (ntoskrnl.exe). Tags: windows, kernel, lpe, privilege-escalation, token-stealing, sedebugprivilege, ntoskrnl, local.binaryHighwindowskernellpeprivilege-escalationtoken-stealingsedebugprivilegentoskrnllocalhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49160-http-sys-http2-bomb-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-49160-http-sys-http2-bomb-dos/High severity — binary · CVE-2026-49160. Status: PoC. Affects: Windows HTTP.sys kernel-mode driver (Windows 10 build 26100 confirmed in crash logs). Tags: windows, http.sys, kernel, http2, dos, bsod, memory-corruption, integer-overflow.binaryHighwindowshttp.syskernelhttp2dosbsodmemory-corruptioninteger-overflowhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20817-windows-wer-alpc-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20817-windows-wer-alpc-lpe/High severity — binary · CVE-2026-20817. Status: PoC. Affects: Windows Error Reporting Service (WerSvc). Tags: windows, wersvc, alpc, lpe, privilege-escalation, ntdll, system32, native-cpp.binaryHighwindowswersvcalpclpeprivilege-escalationntdllsystem32native-cpphttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3008-notepadpp-formatstring/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3008-notepadpp-formatstring/Medium severity — binary · CVE-2026-3008. Status: PoC. Affects: Notepad++ 8.9.3. Tags: notepad++, format-string, wsprintfw, dos, information-disclosure, localization, windows.binaryMediumnotepad++format-stringwsprintfwdosinformation-disclosurelocalizationwindowshttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36981-minitool-kernel-driver-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36981-minitool-kernel-driver-lpe/High severity — binary · CVE-2026-36981. Status: PoC. Affects: MiniTool pwdrvio.sys kernel driver. Tags: minitool, kernel-driver, write-what-where, lpe, arbitrary-kernel-write, windows.binaryHighminitoolkernel-driverwrite-what-wherelpearbitrary-kernel-writewindowshttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36980-minitool-kernel-driver-bsod-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-36980-minitool-kernel-driver-bsod-dos/Medium severity — binary · CVE-2026-36980. Status: PoC. Affects: MiniTool pwdrvio.sys kernel driver. Tags: minitool, kernel-driver, ioctl, bsod, dos, pool-corruption, windows.binaryMediumminitoolkernel-driverioctlbsoddospool-corruptionwindowshttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41091-defender-link-following-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-41091-defender-link-following-lpe/High severity (CVSS 7.8) — binary · CVE-2026-41091. Status: Weaponized. Affects: Microsoft Defender / Microsoft Malware Protection Engine. Tags: windows, microsoft-defender, link-following, cwe-59, cloud-files-api, ntfs-junction, oplock, privilege-escalation, lpe.binaryHighwindowsmicrosoft-defenderlink-followingcwe-59cloud-files-apintfs-junctionoplockprivilege-escalationlpehttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0827-lenovo-lde-file-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0827-lenovo-lde-file-write/High severity — binary · CVE-2026-0827 (Lenovo advisory LEN-210693). Status: PoC. Affects: Lenovo LDE (LdeApi.Server.exe). Tags: lenovo, lde, windows, junction, ntfs-symlink, privilege-escalation, unimpersonated-write, local-privesc.binaryHighlenovoldewindowsjunctionntfs-symlinkprivilege-escalationunimpersonated-writelocal-priveschttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0828-killchain-driver-ioctl/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0828-killchain-driver-ioctl/High severity — binary · CVE-2026-0828. Status: Weaponized. Affects: ProcessMonitorDriver.sys (vulnerable third-party kernel driver). Tags: byovd, kernel-driver, ioctl, process-termination, edr-killer, windows, privilege-escalation, defender-bypass.binaryHighbyovdkernel-driverioctlprocess-terminationedr-killerwindowsprivilege-escalationdefender-bypasshttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0776-discord-search-path/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0776-discord-search-path/High severity (CVSS 7.3) — binary · CVE-2026-0776 (ZDI-CAN-27057, credit: Trend Micro Zero Day Initiative). Status: PoC. Affects: Discord Desktop Client (Windows). Tags: discord, cwe-427, search-path-hijack, node-modules, local-code-execution, windows, electron.binaryHighdiscordcwe-427search-path-hijacknode-moduleslocal-code-executionwindowselectronhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-30332-balena-etcher-toctou/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-30332-balena-etcher-toctou/High severity — binary · CVE-2026-30332. Status: Weaponized. Affects: Balena Etcher for Windows. Tags: toctou, windows, uac, privilege-escalation, balena-etcher, race-condition, temp-file.binaryHightoctouwindowsuacprivilege-escalationbalena-etcherrace-conditiontemp-filehttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-1880-asus-driverhub-toctou-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-1880-asus-driverhub-toctou-lpe/Medium severity — binary · CVE-2026-1880. Status: PoC. Affects: ASUS DriverHub (driver update utility). Tags: windows, toctou, race-condition, lpe, driverhub, asus, local-privilege-escalation, shellexecute.binaryMediumwindowstoctourace-conditionlpedriverhubasuslocal-privilege-escalationshellexecutehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22444-solr-unc-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22444-solr-unc-rce/Critical severity — web · CVE-2026-22444. Status: Weaponized. Affects: Apache Solr, standalone mode, running on Windows. Tags: apache-solr, rce, unc-path, smb, configset, javascript-script-update-processor, windows, cwe-20.webCriticalapache-solrrceunc-pathsmbconfigsetjavascript-script-update-processorwindowscwe-20https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-7791-aws-workspaces-skylight-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-7791-aws-workspaces-skylight-lpe/High severity — cloud · CVE-2026-7791. Status: PoC. Affects: Amazon WorkSpaces — Skylight Workspace Config Service. Tags: aws, amazon-workspaces, skylight, toctou, privilege-escalation, arbitrary-file-write, windows, directory-junction.cloudHighawsamazon-workspacesskylighttoctouprivilege-escalationarbitrary-file-writewindowsdirectory-junctionhttps://poc.intelseclab.com/pocs/binary/2026-07-03_vlc-vp9-reschange-crash/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-03_vlc-vp9-reschange-crash/Medium severity — binary · None assigned as of 2026-07-03. Status: Incomplete PoC. Affects: VLC media player, bundled FFmpeg VP9 decoder (plugins/codec/libavcodec_plugin.dll). Tags: vlc, ffmpeg, vp9, ivf, heap-overflow, media-parsing, crash, windows, decoder.binaryMediumvlcffmpegvp9ivfheap-overflowmedia-parsingcrashwindowsdecoderhttps://poc.intelseclab.com/pocs/binary/2026-07-03_systeminformer-phsvc-trusted-host-lpe/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-03_systeminformer-phsvc-trusted-host-lpe/High severity — binary · None assigned as of 2026-07-03. Status: PoC. Affects: System Informer (Process Hacker successor), phsvc helper process. Tags: windows, system-informer, process-hacker, lpe, confused-deputy, alpc, phsvc, authenticode, local-privilege-escalation.binaryHighwindowssystem-informerprocess-hackerlpeconfused-deputyalpcphsvcauthenticodelocal-privilege-escalationhttps://poc.intelseclab.com/pocs/network/2026-07-03_openvpn-connect-server-pushed-option-ace/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_openvpn-connect-server-pushed-option-ace/High severity — network · None assigned as of 2026-07-03. Status: PoC. Affects: OpenVPN Connect for Windows. Tags: openvpn, openvpn-connect, malicious-vpn-server, command-execution, script-permission-bypass, pushed-options, windows, client-side.networkHighopenvpnopenvpn-connectmalicious-vpn-servercommand-executionscript-permission-bypasspushed-optionswindowsclient-sidehttps://poc.intelseclab.com/pocs/network/2026-07-03_libssh2-publickey-list-parser-oob/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_libssh2-publickey-list-parser-oob/Critical severity — network · None assigned as of 2026-07-03. Status: Weaponized. Affects: libssh2, publickey subsystem list parser (src/publickey.c). Tags: libssh2, ssh, publickey-subsystem, heap-overflow, use-after-free, integer-overflow, windows, rce, memory-corruption.networkCriticallibssh2sshpublickey-subsystemheap-overflowuse-after-freeinteger-overflowwindowsrcememory-corruptionhttps://poc.intelseclab.com/pocs/binary/2026-07-03_imagemagick-ghostscript-delegate-hijack/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-03_imagemagick-ghostscript-delegate-hijack/High severity — binary · None assigned as of 2026-07-03. Status: PoC. Affects: ImageMagick (Ghostscript delegate for PDF/PS/EPS conversion) on Windows. Tags: imagemagick, ghostscript, windows, search-path-hijack, dll-planting-adjacent, delegate-execution, code-execution, pdf.binaryHighimagemagickghostscriptwindowssearch-path-hijackdll-planting-adjacentdelegate-executioncode-executionpdfhttps://poc.intelseclab.com/pocs/web/2026-07-03_flowise-mcp-env-var-case-bypass/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_flowise-mcp-env-var-case-bypass/High severity — web · None assigned as of 2026-07-03. Status: PoC. Affects: Flowise / flowise-components. Tags: flowise, mcp, model-context-protocol, windows, environment-variable, case-insensitivity, node-options, rce.webHighflowisemcpmodel-context-protocolwindowsenvironment-variablecase-insensitivitynode-optionsrcehttps://poc.intelseclab.com/pocs/binary/2026-07-03_anydesk-printer-pipe-com-impersonation-lpe/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-03_anydesk-printer-pipe-com-impersonation-lpe/High severity — binary · None assigned as of 2026-07-03. Status: PoC. Affects: AnyDesk for Windows 9.7.6. Tags: anydesk, windows, privilege-escalation, com-impersonation, named-pipe, local-service, lpe, ipc.binaryHighanydeskwindowsprivilege-escalationcom-impersonationnamed-pipelocal-servicelpeipchttps://poc.intelseclab.com/pocs/misc/2026-07-03_7zip-rar5-motw-ads-bypass/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-03_7zip-rar5-motw-ads-bypass/High severity — misc · None assigned as of 2026-07-03. Status: PoC. Affects: 7-Zip 26.01 x64 for Windows. Tags: 7-zip, rar5, mark-of-the-web, alternate-data-streams, ntfs, motw-bypass, windows, archive-extraction.miscHigh7-ziprar5mark-of-the-webalternate-data-streamsntfsmotw-bypasswindowsarchive-extractionhttps://poc.intelseclab.com/pocs/binary/2026-06-28_cve-2026-45586-ctfmon-greenplasma-lpe/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-28_cve-2026-45586-ctfmon-greenplasma-lpe/High severity (CVSS 7.8) — binary · CVE-2026-45586. Status: PoC. Affects: Windows Collaborative Translation Framework (CTFMON service). Tags: LPE, EoP, Windows, CTFMON, section-object, object-directory, link-following, zero-day, CTF-challenge, Windows-11, Windows-2022, Windows-2026, incomplete-poc.binaryHighLPEEoPWindowsCTFMONsection-objectobject-directorylink-followingzero-dayCTF-challengeWindows-11Windows-2022Windows-2026incomplete-pochttps://poc.intelseclab.com/pocs/binary/2026-05-28_notepad-plus-plus-8-9-6-multi-cve/Thu, 28 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-28_notepad-plus-plus-8-9-6-multi-cve/High severity (CVSS 5) — binary · CVE-2026-48770, CVE-2026-48778, CVE-2026-48800. Status: Patched. Affects: Notepad++. Tags: Notepad++, Windows, OOB-read, DoS, command-injection, config.xml, shortcuts.xml, local.binaryHighNotepad++WindowsOOB-readDoScommand-injectionconfig.xmlshortcuts.xmllocalhttps://poc.intelseclab.com/pocs/binary/2026-05-17_windows-ntlm-hash-disclosure-cve-2025-24054/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-ntlm-hash-disclosure-cve-2025-24054/Medium severity (CVSS 6.5) — binary · CVE-2025-24054. Status: Patched. Affects: Windows File Explorer (Windows Shell). Tags: NTLM, NTLMv2, hash-disclosure, zero-click, Windows, File-Explorer, UNC, SMB, credential-theft, in-the-wild, state-sponsored.binaryMediumNTLMNTLMv2hash-disclosurezero-clickWindowsFile-ExplorerUNCSMBcredential-theftin-the-wildstate-sponsoredhttps://poc.intelseclab.com/pocs/binary/2026-05-17_windows-mmc-eviltwin-cve-2025-26633/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_windows-mmc-eviltwin-cve-2025-26633/High severity — binary · CVE-2025-26633. Status: Patched. Affects: Microsoft Management Console (MMC), Windows. Tags: RCE, Windows, MMC, MSC, ActiveX, EvilTwin, APT, EncryptHub, Water-Gamayun, zero-day, in-the-wild.binaryHighRCEWindowsMMCMSCActiveXEvilTwinAPTEncryptHubWater-Gamayunzero-dayin-the-wildhttps://poc.intelseclab.com/pocs/web/2026-05-17_toolshell-sharepoint-chain/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_toolshell-sharepoint-chain/Critical severity — web · CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706. Status: Weaponized. Affects: Microsoft SharePoint Server. Tags: RCE, SharePoint, unauthenticated, deserialization, auth-bypass, APT27, APT31, ransomware, Windows, IIS.webCriticalRCESharePointunauthenticateddeserializationauth-bypassAPT27APT31ransomwareWindowsIIShttps://poc.intelseclab.com/pocs/binary/2026-05-16_cve-2025-21298-outlook-rtf-rce/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-16_cve-2025-21298-outlook-rtf-rce/Critical severity (CVSS 9.8) — binary · CVE-2025-21298. Status: Researched. Affects: Microsoft Windows OLE (ole32.dll) as reached by Outlook/Word RTF parsing. Tags: RCE, zero-click, Outlook, RTF, OLE, ole32, Windows, memory-corruption, unauthenticated.binaryCriticalRCEzero-clickOutlookRTFOLEole32Windowsmemory-corruptionunauthenticatedhttps://poc.intelseclab.com/pocs/binary/2026-05-16_adobe-acrobat-prototype-pollution-sandbox-escape/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-16_adobe-acrobat-prototype-pollution-sandbox-escape/Critical severity (CVSS 9.8) — binary · CVE-2026-34621. Status: Weaponized. Affects: Adobe Acrobat DC / Adobe Acrobat Reader DC / Adobe Acrobat 2024 JavaScript engine sandbox boundary. Tags: prototype-pollution, sandbox-escape, Adobe-Acrobat, Adobe-Reader, PDF, RCE, Windows, macOS, user-interaction.binaryCriticalprototype-pollutionsandbox-escapeAdobe-AcrobatAdobe-ReaderPDFRCEWindowsmacOSuser-interactionhttps://poc.intelseclab.com/pocs/misc/2026-05-15_winrar-path-traversal-cve-2025-6218/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-05-15_winrar-path-traversal-cve-2025-6218/High severity — misc · CVE-2025-6218. Status: Weaponized. Affects: WinRAR archive extraction workflow. Tags: path-traversal, arbitrary-file-write, startup-folder, WinRAR, Windows, user-interaction.miscHighpath-traversalarbitrary-file-writestartup-folderWinRARWindowsuser-interactionhttps://poc.intelseclab.com/pocs/binary/2026-05-15_miniplasma-cve-2020-17103/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_miniplasma-cve-2020-17103/High severity (CVSS 7.8) — binary · CVE-2020-17103. Status: Weaponized. Affects: Windows Cloud Files Mini Filter Driver (cldflt.sys) / cldapi.dll. Tags: LPE, Windows, cldflt.sys, Cloud Files API, registry-symlink, race-condition, WER-hijack, SYSTEM-shell, local-user.binaryHighLPEWindowscldflt.sysCloud Files APIregistry-symlinkrace-conditionWER-hijackSYSTEM-shelllocal-userhttps://poc.intelseclab.com/pocs/network/2026-05-15_cve-2021-31166-http-sys-uaf/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-15_cve-2021-31166-http-sys-uaf/Critical severity (CVSS 9.8) — network · CVE-2021-31166. Status: Weaponized. Affects: Microsoft Windows HTTP Protocol Stack (http.sys). Tags: HTTP.sys, use-after-free, RCE, Windows, kernel, unauthenticated.networkCriticalHTTP.sysuse-after-freeRCEWindowskernelunauthenticatedhttps://poc.intelseclab.com/pocs/binary/2026-05-15_cve-2024-21338-admin-to-kernel/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-15_cve-2024-21338-admin-to-kernel/High severity (CVSS 7.8) — binary · CVE-2024-21338. Status: Weaponized. Affects: Microsoft Windows AppLocker driver path (\\Device\\AppID). Tags: LPE, Windows, AppLocker, token-impersonation, HVCI, admin-to-kernel, local-user.binaryHighLPEWindowsAppLockertoken-impersonationHVCIadmin-to-kernellocal-user