CVE-2026-21509-handler

CVE-2026-21509 Office Kill-Bit Manager PowerShell script to check, apply, and test the Kill-Bit protection for the CVE-2026-21509 Microsoft Office zero-day vulnerability affecting Office 2016/2019/LTSC. What is CVE-2026-21509? Critical RCE vulnerability in Microsoft Office OLE/COM handling CVSS...

detect_CVE-2026-21509

Detections for the CVE-2026-21509 vulnerability in MS Office This repository contains a YARA rule to detect RTF documents with a potential exploit for CVE-2026-21509, and a Python script to check if MS Office files contain Shell.Explorer.1 OLE objects, which is related to that vulnerability. See...

SCTT-2026-33-0007-The-OLE-Vortex-Laminar-Bypass-

SCTT-2026-33-0007-The-OLE-Vortex-Laminar-Bypass- Microsoft just released emergency patches for CVE-2026-21509, a zero-day in the Office Suite that bypasses OLE/COM mitigations when a user simply opens a file. They think their "Service-side change" for Office 2021+ is a solid wall...

CTT-MICROSOFT-OFFICE-OLE-MANIFOLD-BYPASS-CVE-2026-21509

🏛️CTT -Microsoft Office OLE Manifold BYPASS CVE-2026-21509 Standardized CTT Implementation for 1096x Temporal Execution ! 📜 Vulnerability Overview CVE-2026-21509 is a critical bypass in the Microsoft Office OLE Object Linking and Embedding validation engine. While standard "laminar" exploits...

LetsDefend-SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298-

LetsDefend-SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298- We are expected to investigate a critical alert reporting a Windows OLE zero-click RCE exploitation CVE-2025-21298 delivered via a malicious RTF attachment. Investigation of the alert from LetsDefend On 4 February...

impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

oletools

python-oletools oletools is a package of python tools to analyze Microsoft OLE2 files also called Structured Storage, Compound File Binary Format or Compound Document File Format, such as Microsoft Office 97-2003 documents, MSI files or Outlook messages, mainly for malware analysis, forensics and...

CVE-2026-21509-PoC

CVE-2026-21509 — Educational Dummy PoC for Defender Visibility ⚠️ This repository provides a harmless, non-exploit Proof of Concept. Its purpose is to support defensive research , EDR/AV visibility testing , and training. It does not exploit CVE‑2026‑21509 and contains only dummy OLE artifacts. 📝...

CVE-2026-21509

CVE-2026-21509 — Microsoft Office OLE Security-Feature Bypass Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here for an actively exploited vulnerability. A security-feature bypass in Microsoft Office that lets a crafted document load COM...

CVE-2022-30190

CVE-2022-30190 Microsoft Office Word RCE Reproduction CVE-2022-30190 Vulnerability Overview MS Office docx files may contain external OLE object references as HTML files. There is an HTML scenario ms-msdt: that calls the msdt diagnostic tool, which is capable of executing arbitrary code specified...

CVE-2022-30190

CVE-2022-30190 aka Follina Vulnerability Description Follina exists in the Microsoft Support Diagnostic Tool MSDT. When an application calls MSDT via a URL protocol for support, a remote code execution vulnerability occurs. Successful exploitation allows an attacker to execute arbitrary code with...

SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298

SOC336 - Windows OLE Zero-Click RCE Exploitation Detected CVE-2025-21298 Walkthrough 🔎 Table of Content 1. Situation 2...

cve-2021-40444

cve-2021-40444 Reverse engineering the "A Letter Before Court 4.docx" malicious files exploting cve-2021-40444 Files including malicious word and cab-file may be downloaded on any.run: https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ Note! The domain name in the original malicious...

Follina_MSDT_CVE-2022-30190

Microsoft explains that “a remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker ca...

PoC-CVE-2022-30190

POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina Info : New Microsoft Office zero-day used in attacks to execute PowerShell Summary On the 29th of May 2022, the NaoSec team, an independent Cyber Security Research Team, discovered a malicious Office document shared on Virustotal. This...

CVE-2022-30190_EXP_PowerPoint

CVE-2022-30190EXPPowerPoint This is exploit of CVE-2022-30190 on PowerPoint. Modify the suffix of the file to 'zip' and unzip the file, you can edit \ppt\slides\rels\slide1.xml.rels and replace to your vps ip:port like this, then compress them as the same way and change the suffix to 'ppsx'. The...

CVE-2017-11882

CVE-2017-11882 CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 MITRE CVE-2017-11882: https://vulners.com/cve/CVE-2017-11882 Research: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about Patch analysis:...

CVE-2025-21298

CVE-2025-21298 content This is a proof-of-concept for CVE-2025-21298 - Windows OLE Remote Code Execution Vulnerability CVSS 9.8. This is a memory corruption PoC , not an exploit. vulnerability The vulnerability is located in ole32.dll!UtOlePresStmToContentsStm. The purpose of the function is ti...

CVE-2018-0802

CVE-2018-0802 CVE-2018-08022: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802 MITRE CVE-2018-0802: https://vulners.com/cve/CVE-2018-0802 0patch exploitation and patch video: https://www.youtube.com/watch?v=XU-U4K270Z4 Qihoo 360 blog post...

CVE-2018-0802

CVE-2018-0802 CVE-2018-08022: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802 MITRE CVE-2018-0802: https://vulners.com/cve/CVE-2018-0802 0patch video de explotación y parche: https://www.youtube.com/watch?v=XU-U4K270Z4 Entrada de blog de Qihoo 360...