pe-bear

PE-bear PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files...

CVE-2022-38694_unlock_bootloader

CVE-2022-38694 An attacker with physical access to the device can overwrite a function pointer somewhere in the BootROM data section or a return address stored on the stack and execute their own code with BootROM privileges. For detailed information, read the article by NCC Group. 快速指路：...

CVE-2024-27398

CVE-2024-27398 PoC de CVE-2024-27398 📍 Puntos de interrupción de GDB root@kitploit: GNU gdb Ubuntu 12.1-0ubuntu122.04.2 12.1 Copyright C 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO...

CVE-2025-52413

CVE-2025-52413 — Particle Device OS BLE 缓冲区溢出 发现者 ：Golden Ticket Labs 厂商 ：Particle 分配日期 ：2025年8月12日（MITRE） 描述 Particle Device OS v5.6.0 的 blecontrolrequestchannel.cpp 组件中存在缓冲区溢出漏洞：由于 memcpy 对 64 字节缓冲区执行无界拷贝，攻击者可覆写任意函数指针。 当与相邻的 ThreadRunner::eventHandler 回调调用结合时，可可靠地劫持控制流，甚至执行模拟的 ROP...

cve-2025-2082-POV

CVE-2025-2082 – Sobrescritura de Puntero de Función PoV estilo VCSEC Este repositorio demuestra una Prueba de Vulnerabilidad PoV que simula una falla crítica de corrupción de memoria inspirada en CVE-2025-2082, descubierta en el componente VCSEC Seguridad del Controlador del Vehículo de Tesla. La...

optee-qemu

CVE-2021-44733: Fuzzing y explotación de un use-after-free en el subsistema TEE del kernel de Linux Recientemente se descubrió una vulnerabilidad de use-after-free en el subsistema TEE del kernel de Linux, hasta la versión 5.15.11 inclusive, y se le asignó CVE-2021-44733 1. A primera vista no...

CVE-2021-38304-PoC

CVE-2021-38304 概念验证 概述 本仓库包含一个针对 National Instruments（美国国家仪器）旧版本 nipalk.sys 驱动程序中严重安全漏洞的概念验证。该漏洞允许在内核模式下执行任意代码并泄露内存。此代码仅供个人研究使用。 描述 nipalk.sys 驱动程序在处理特定 IOCTL 请求时，未能正确处理用户提供的指针。此缺陷使攻击者能够提供一个函数指针，驱动程序会以受控参数在内核上下文中调用该指针。 关键要点 函数指针控制 ：驱动程序在未进行适当验证的情况下调用用户提供的函数指针。 参数控制 ：攻击者可以在函数调用期间控制 RCX 和 RDX 寄存器。...

CVE-2025-65018_Exploit_Challenge

CVE-2025-65018 CTF 挑战："PNG Panic" 该挑战基于 libpng 中的真实缓冲区溢出漏洞（特别是在处理 16 位隔行扫描图像时，简化 API pngimagefinishread 中的问题）。 🚩 挑战目标 给定一个易受攻击的二进制文件 victim，它使用静态链接的、存在漏洞的 libpng 版本。该应用程序将一个名为 exploit.png 的 PNG 文件读入缓冲区。 你的目标是构造一个恶意的 PNG 文件，触发堆溢出，覆盖 Logger 结构体（位于图像缓冲区之后）中的函数指针，将执行重定向到 win 函数，从而生成一个 shell。 🛠️ 搭建与构建...

UBUNTU-CVE-2026-80691

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

EUVD-2026-67426

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

PT-2026-82118

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the regmap sdw mbq poll busy function where the system attempts to call the readable reg callback without verifying if it is set. Because this callback is optional,...

CVE-2026-13212

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

CVE-2026-13212 Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

CVE-2026-13212 Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

CVE-2026-13212

The Zephyr RTOS virtio driver contains an out-of-bounds read in virtio_isr() (drivers/virtio/virtio_common.c). The device-written descriptor-chain head id from the used ring is used directly as an index into recv_cbs[] and desc[] without a bounds check. A malicious or compromised virtio backend (...

PT-2026-80901

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio isr drivers/virtio/virtio common.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recv cbs and vq-desc, which are both allocated with...

Wargame-Exploitation-Project

Exploit Script - Level 3 - Kỹ thuật: Buffer Overflow Trà...

ANT-2026-C6E98TYX · liboqs · Uninitialized Function Pointer (CWE-824)

other high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-C6E98TYX: 01-liboqs-ntru-uninit-fn-ptr The NTRU constructors in...

CVE-2026-43629 llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore

llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the statereaddata function computes write size without overflow checking, allowing attackers with write access to the slotsavepath directory to corrupt heap memory. Attackers...

RLSA-2026:49870 Low: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 Bug Fixes and Enhancements: Possible regression with FM350GL rhel-9.8.z JIRA:Rocky...