CVE-2017-11882-Blocker

CVE-2017-11882-Blocker Un controlador de Windows que neutraliza CVE-2017-11882 : Cómo funciona Este proyecto se divide en un controlador de kernel y un componente de notificación en modo usuario que se comunican a través de un dispositivo personalizado utilizando el modelo de llamada invertida...

criPPLe

criPPLe Controlador de kernel de Windows que elimina la Protección de Procesos PP y la Protección de Procesos Light PPL. Esto fue creado con la ayuda del "Curso de Desarrollo de Controladores Ofensivos" de Zero-Point Security Este controlador de kernel elimina la protección de procesos de un pid...

CVE-2020-15368-AsrDrv103-research

CVE-2020-15368 — AsrDrv103.sys This repository contains my materials related to the reverse engineering of the ASRock AsrDrv103.sys Windows kernel driver associated with CVE-2020-15368. The project was created as a practical study of Windows kernel drivers, driver communication interfaces,...

HITCON-2023-Demo-CVE-2023-20562

HITCON 2023 Demo CVE-2023-20562 Description This demonstration took place at HITCON 2023 in Taiwan. The demo highlights the exploitation of AMDCpuProfiler.sys within AMD μProf. By triggering an arbitrary write on the EPROCESS token, privilege escalation to SYSTEM level is achieved. Disabling the...

CVE-2026-69421

Integer underflow wrap or wraparound in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...

EUVD-2026-73489

Integer underflow wrap or wraparound in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...

PT-2026-87452

Integer underflow wrap or wraparound in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...

AxHunter — Updated!

AxHunter PoCs for Wellbia XIGNCODE3 anti-cheat xhunter driver family — xhunter1.sys v2023.12.7.78 CVE-2026-3609 and xhunter2.sys v2026.6.1.192 CVE-2026-15430. Workspace layout Cargo workspace, three crates: AxHunter/ ├── Cargo.toml workspace manifest ├── axhunter-lsa/ shared crate — driver-agnost...

CVE-2026-62699 Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability

...

EUVD-2026-43769

Use after free in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-58602

CVE-2026-58602 is a Windows kernel-mode-driver vulnerability described as a use-after-free that enables an authorized, local attacker to achieve elevation of privilege. The public documents do not provide product/vendor specifics beyond “Windows kernel” and “kernel-mode driver,” nor details on af...

SignalRGB kernel driver contains improper access control and IOCTL vulnerabilities

Overview The SignalRGB kernel driver, SignalIo.sys, contains two vulnerabilities involving improper access control and unsafe memory handling. The device object is created with an overly permissive Discretionary Access Control List DACL that allows user-mode processes to access privileged hardwar...

CVE-2026-8501

Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit...

CVE-2026-8501

Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit...

CVE-2026-8501

The PCTCore64.sys Windows kernel driver, part of the discontinued PC Tools Internet Security suite, contains an improper access control vulnerability. The driver fails to apply a restrictive security descriptor when creating the \.\PCTCoreDriver WDM device object, allowing unprivileged user-mode ...

EUVD-2026-33669

Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit...

CVE-2026-8501

Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit...

CVE-2026-8501: Exposed IOCTL with Insufficient Access Control

Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit...

PCTCore64.sys Windows kernel driver contains missing access control vulnerability

Overview The PCTCore64.sys Windows kernel driver from PC Tools Internet Security exposes its \.\PCTCoreDriver device interface with no access control, allowing any user-mode process to interact with the driver and invoke privileged IOCTL I/O Control commands. In a Bring Your Own Vulnerable Driver...

The vulnerability of the Win32k.sys component of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Win32k.sys component of the Windows operating system is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability can allow an attacker to increase their privileges...