CVE-2026-50369

CVE-2026-50369 针对 Windows Server 2025 RDS 会话主机上 rdpcorets.dll!CRdpPipeGfxPlugin::Enable 中 TOCTOU 竞态条件的复现程序。 我将其报告为 DoS；该代码路径似乎还以某种方式启用了 EoP。 此复现程序仅是 DoS 路径的 PoC。 漏洞 Enable 在 this+0x60 处两次读取 COM 接口指针，且未进行同步。TerminateInstance 在其自身临界区范围之外清除同一字段。两者通过 PnP 设备到达和移除工作项在 NT 线程池上并发执行。第二次读取解引用空指针 → 访问冲突 →...

The vulnerability of the implementation of the CRdpPipeGfxPlugin component in the system DLL file rdpcorets.dll of the Remote Desktop Services (RDS) service for Windows operating systems allows a malicious individual to escalate their privileges or cause service failures.

The vulnerability of the CRdpPipeGfxPlugin component in the system DLL file rdpcorets.dll of the Remote Desktop Services RDS service on Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their...