CVE-2018-14442

Foxit Reader CPDFParser::mpCryptoHandler Use After Free 1. PDF Format Background 2. Encryption Dictionaries 3. Vulnerability Details 4. ASLR and DEP Bypass 5. Environment Details 6. Trigger 7. Author PDF Format Background PDF is a file format used to represent documents. A pdf is made of multiple...

gsscred-move-uaf

GSSCred-move-uaf The com.apple.GSSCred XPC service, which runs as root on macOS and iOS, does not properly implement the "move" command, leading to a use-after-free condition in the doMove function. The GSSCred service can be reached from within the default application sandbox on iOS. This progra...

CVE-2025-62215-POC

CVE-2025-62215 — Windows Token UAF SepTokenSidSharingEnabled Race Condition This repository is for educational and research purposes only. Overview A Use-After-Free vulnerability PoC that occurs in the SepTokenSidSharingEnabled optimization path of the Windows kernel. When NtDuplicateToken...

CVE-2017-11176

CVE-2017-11176 Proof of concept for CVE-2017-11176 for code execution. Vulnerability The mqnotify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial...

CVE-2026-43499-Redmi-Turbo5

CVE-2026-43499 Exploit for Redmi Turbo 5 This preload library is built from the duchamp-root source code. ⚠️ WARNING: For educational and authorized security research purposes only. This repository provides a proof-of-concept exploit for CVE-2026-43499 GhostLock targeting the Xiaomi Redmi Turbo 5...

ghostlock-emerald

GhostLock for POCO M6 Pro emerald GhostLock CVE-2026-43499 is a 15-year-old Linux kernel use-after-free in the futex priority-inheritance code that lets any local user gain root. This project uses it to root the POCO M6 Pro MediaTek Helio G99 Ultra / MT6789 and install KernelSU on a locked...

Januscape

Januscape: Escape de Invitado a Anfitrión en KVM/x86 Resumen Este documento describe la vulnerabilidad Januscape CVE-2026-53359 descubierta e informada por Hyunwoo Kim @v4bel. Es una vulnerabilidad de escape de KVM que permite que un invitado escape al anfitrión en un entorno KVM/x86. Hasta donde...

CVE-2024-38399

DISCLAIMER All content provided is for educational and research purposes only. All testing was conducted exclusively on an Samsung Snapdragon Gen 1 device, owned legally by the author, in a safe, isolated environment. No production systems or devices owned by others were involved or affected duri...

WebKit-UAF-ANGLE-OOB-Analysis

WebKit-UAF-ANGLE-OOB-Analysis CVE-2025-43529, CVE-2025-14174 Notes and PoC material for a WebKit/ANGLE chain on iOS 26.1. This is not a full exploit; it separates verified primitives from the pieces that still fail. Author: zeroxjf Based on: jir4vv1t's CVE-2025-43529 exploit Status: Partial chain...

CVE-2025-49844

CVE-2025-49844 - RediShell Use-after-free in Redis Lua scripting leading to remote code execution. Summary of the CVE Redis is an open source, in-memory database. CVE-2025-49844 is a use-after-free vulnerability in Redis's embedded Lua scripting engine. An authenticated user with access to Lua...

CVE-2019-2215

CVE-2019-2215 The following issue exists in the android-msm-wahoo-4.4-pie branch of https://android.googlesource.com/kernel/msm and possibly others: There is a use-after-free of the wait member in the binderthread struct in the binder driver at /drivers/android/binder.c. As described in the...

CVE-2019-2215

CVE-2019-2215 PoC for old Binder vulnerability based on P0 exploit Description A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the...

CVE-2026-43655-AppleM2ScalerCSCDriver-UAF

CVE-2026-43655: AppleM2ScalerCSCDriver shared scheduler use-after-free Public technical disclosure for CVE-2026-43655 , an AppleM2ScalerCSCDriver / IOSurfaceAccelerator use-after-free reachable from the default iOS app sandbox with no special entitlements. Apple addressed this issue in iOS 26.5 /...

CVE-2024-27398

CVE-2024-27398 CVE-2024-27398 POC 📍 GDB Breakpoints root@kitploit: GNU gdb Ubuntu 12.1-0ubuntu122.04.2 12.1 Copyright C 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the...

slides

slides A collection of slides. 2025 A tale of challenging MTE: Rooting Google Pixel with kernel MTE enabled in one shot Conference: POC 2025 2024 Simple bug but not easy exploit: Rooting Android devices in one shot Conference: Cansecwest 2024 Almost same with POC 2023, except for MTE 2023 Simple...

CVE-2026-43499-aristotle-apk

Aristotle ADB Enable A minimal Android app that turns on ADB on an au/KDDI Xiaomi "aristotle" XIG04, Android 12 whose developer options can't be reached, using a temporary root obtained from CVE-2026-43499. It is a device-owner tool in the same category as KingRoot: it roots your own phone to fli...

STIG-Edge-RCE-CVE2025-9478

STIG – Microsoft Edge Chromium 139.0.3405.125 Remote Code Execution CVE-2025-9478, Plugin ID: 258091 Before Finding: Microsoft Edge version 139.0.3405.86 was outdated and vulnerable to a critical Remote Code Execution RCE flaw CVE-2025-9478. Risk: Attackers could exploit a use-after-free in ANGLE...

cve-2016-0728-testbed

CVE-2016-0728 testbed This repository contains a test program for CVE-2016-0728, a refcount leak and overflow bug in Linux, that leads to a use-after-free. The bug was found and explained by Perception Point. I am not affiliated to them. Usage root@kitploit: Welcome to the CVE-2016-0728 testbed...

CVE-2026-42978-PoC-Research

CVE-2026-42978 PoC & Research — Windows Push Notifications Use-After-Free Race condition in Windows Push Notifications service WpnService that runs as NT AUTHORITY\SYSTEM. An attacker with local access can trigger a use-after-free during platform shutdown and potentially elevate privileges. CVE:...

clr

CLR C hecker of L ifetimes and other R efinement types for Zig Video: https://www.youtube.com/watch?v=mf0WzTOe-40 Sponsorship: https://buymeacoffee.com/dnautics discuss on hn: https://news.ycombinator.com/item?id=42923829 discuss on lobste.rs: https://lobste.rs/s/9sitsj/clrcheckerforlifetimesothe...