experiments

实验 各种实验 / PoC 的仓库。 debugging-secure-kernel: PoC：在 QEMU KVM 之上使用 gdb 调试 Windows 10 安全内核 dns: 有关 DNS / 证书透明度 / 同形字（Homoglyphs）的实验 Attack Surface Reduction: 揭秘 Windows 攻击面减少（Attack Surface Reduction）的内部机制 VDM: Windows Defender 的 VDM 格式（签名数据库） Primary Group ID: 分析对 primaryGroupID AD 属性更改执行的安全检查...

CVE-2026-26179

CVE-2026-26179 CVE-2026-26179 / ZDI-26-276 的概念验证，我自己的安全内核漏洞。 我很清楚我有一个专门的仓库来存放我的漏洞和/或利用代码，但这个漏洞对我来说特别特殊。因此，我决定给它单独建立一个仓库。我还计划在有空的时候为它写一篇分析文章。现在，我认为我不应该等到博客文章发布才公开它，而是提早放出。这样的话，我相信这是除了MSRC会议中介绍的两个漏洞之外，最早公开的安全内核漏洞之一（如果不是最早的话）。 这个仓库很仓促，我以后会整理。...

CVE-2026-85921

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

EUVD-2026-77686

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

CVE-2026-85921

CVE-2026-85921 is a double free vulnerability in Windows Secure Kernel Mode that allows an authorized attacker to elevate privileges locally . The CVSS 3.1 score is 8.2 (HIGH) with a local attack vector, low complexity, high privileges required, and changed scope , resulting in high impact to con...

Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

CVE-2026-85921: Double Free

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

PT-2026-91284

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A double free issue in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. A double free occurs when the system attempts to free the same memory location...

CVE-2026-83939

Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

CVE-2026-69906

Heap-based buffer overflow in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

CVE-2026-69846

Integer overflow or wraparound in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

CVE-2026-69501

Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

CVE-2026-83939

Windows Secure Kernel Mode is affected by an untrusted pointer dereference vulnerability that allows an authorized attacker to perform a local privilege escalation . The CVSS 3.1 score is 8.2 (HIGH) , with a changed scope and high impact to confidentiality, integrity, and availability. The attack...

EUVD-2026-73885

Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

EUVD-2026-73725

Heap-based buffer overflow in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

CVE-2026-69906

Windows Secure Kernel Mode vulnerability (CVE-2026-69906) involves a heap-based buffer overflow that allows an authorized local attacker to elevate privileges . The vulnerability crosses a security boundary (scope changed), resulting in high impact to confidentiality, integrity, and availability....

EUVD-2026-73246

Integer overflow or wraparound in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

CVE-2026-69846

An integer overflow or wraparound in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. The flaw requires high privileges and low attack complexity with no user interaction, but changes scope to affect the full system with high impact on confidentiality, integ...

EUVD-2026-73135

Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

CVE-2026-69501

CVE-2026-69501 is an untrusted pointer dereference in Windows Secure Kernel Mode that allows an authorized local attacker to achieve privilege escalation . The underlying cause is improper handling of a pointer in the Secure Kernel Mode component, leading to arbitrary memory access in a high-priv...