CVE-2026-106113

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...

CVE-2026-106111

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the fu...

KDU

KDU 内核驱动实用工具 系统要求 x64 Windows 7/8/8.1/10/11； 需要管理员权限。 用途与功能 本工具旨在提供一种简单的方式来探索 Windows 内核/组件，无需进行大量配置或使用本地调试器。 其功能包括： 通过任意 PPL 或任意进程句柄进行受保护进程劫持，两者均通过修改 EPROCESS 对象实现； 驱动程序签名强制覆盖器（类似于 DSEFix）； 用于绕过驱动程序签名强制的驱动程序加载器（类似于 TDL/Stryker）； 支持多种用作功能“提供者”的易受攻击驱动程序。 用法 KDU -list KDU -listcsv KDU -diag KDU -pr...

CVE-2026-106118 ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore...

CVE-2026-106118

The ImageSharp 2D graphics library (versions 3.0.0 through 4.1.1 ) is vulnerable to a heap out-of-bounds write during tiled TIFF decoding. The root cause is a mismatch where the destination buffer is allocated using TileWidth , but the T4, T6, and Modified Huffman decompressors are constructed us...

CVE-2026-106118 ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore...

CVE-2026-106118 ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore...

CVE-2026-106113 ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...

CVE-2026-106113 ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...

CVE-2026-106113

The ImageSharp 2D graphics library (versions 2.0.0 through 4.1.2 ) is vulnerable to an out-of-bounds access during the decoding of an attacker-supplied 32-bit floating-point TIFF as Image . When HistogramEqualization is applied, ColorNumerics.GetBT709Luminance can produce non-finite or out-of-ran...

CVE-2026-106113 ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the...

CVE-2026-106111 ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the fu...

CVE-2026-106111

The ImageSharp 2D graphics library (versions 4.0.0 through 4.1.2 ) is vulnerable to a memory disclosure issue in its EXR ZIP decoder. Specifically, the ExrBaseDecompressor.UndoZipCompression method can accept a ZIP or ZIPS inflate result shorter than the required block size. This causes ExrDecode...

CVE-2026-106111 ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the fu...

CVE-2026-106110 ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and...

CVE-2026-106110 ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and...

NullGate

NullGate 本项目实现了一种便捷且现代的方式来使用 NTAPI 函数，通过间接系统调用（indirect syscalls），并结合了 FreshyCalls 方法，在动态获取系统调用编号方面做了一点改动。 它还使用了一种我尚未见他人提及的技术来绕过 Windows Defender 的内存扫描。 该项目使用该库实现了一个经典的 PoC 进程注入器。 同时提供了一些便捷的加密函数。 演示 构建 要构建示例，请使用 -DNULLGATEBUILDSAMPLE=ON。 如果你直接构建 nullgate，产物会位于 /sample.exe；如果是作为依赖构建，则在...

Enumprotections_BOF

Enumprotections BOF このBOFは、システムプロセスを列挙し、それぞれの保護レベルを特定するために使用できます。サービス関連、ユーザー、セッション、パスなどの追加情報も返されます。これらの情報を組み合わせることで、SYSTEMレベルのDLLハイジャックを調査するための有力な候補を特定できます。理想的なプロセスは次のとおりです。 1. 保護されていない 2. サービスに関連付けられているため、開始/停止が可能 3. サードパーティ製ソフトウェア。MicrosoftはMicrosoftコンポーネントのハイジャック検出に長けています。 使用方法 コンパイル...

windows-api-function-cheatsheets

Windows API 関数チートシート 連絡先 🌨️ Snowcrash: [email protected] 目次 Windows API 関数チートシート ファイル操作 プロセス管理 メモリ管理 スレッド管理 ダイナミックリンクライブラリ DLL 管理 同期 プロセス間通信 Windows フック 暗号化 デバッグ Winsock レジストリ操作 エラー処理 リソース管理 Unicode 文字列関数 文字列長 文字列コピー 文字列連結 文字列比較 文字列検索 文字分類と変換 Win32 構造体チートシート 一般的な構造体 Win32 ソケット構造体チートシート...

CVE-2026-74939-escape-the-mac-n-cheese-box

CVE-2026-74939 — Firefox content→parent 权限提升 针对 Firefox 149.0a1 nightly（2fbc0748c4，修复前）中沙箱逃逸的概念验证。受入侵的 content 进程伪造一条 IPDL 消息，使 parent 进程将页面加载到 特权 （privilegedabout）进程中。 这是第二阶段沙箱逃逸，设计用于在 content 进程 RCE（例如 CVE-2026-2796）之后进行链接利用。 该漏洞（Mozilla bug 2054416） Parent 进程从 content→parent 的 IPDL 消息中反序列化...