DumpGuard

DumpGuard DumpGuard is a credential dumping and protocol research tool for modern Windows systems. It abuses the Remote Credential Guard protocol to recover credential material even when Credential Guard is enabled, and also includes a Microsoft v1 authentication package path for session-oriented...

NativeBypassCredGuard

NativeBypassCredGuard NativeBypassCredGuard is a tool designed to bypass Credential Guard by patching WDigest.dll using only NTAPI functions exported by ntdll.dll. It is available in two flavours: C and C++. The tool locates the pattern "39 ?? ?? ?? ?? 00 8b ?? ?? ?? ?? 00" in the WDigest.dll fil...

dumpguard_bof

DumpGuard BOF Beacon Object File BOF port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems. About This Project This repository contains a Beacon Object File BOF implementation of DumpGuard, ported from the original C/.NET implementation to pure C for use with Havo...

lazarus-sigma-rules

Lazarus Sigma Rules The Sigma rules in this repository were created by the F-Secure Countercept Detection and Response Team to provide detection coverage for the Tools, Techniques and Procedures recently used by the Lazarus Group. The blog posts discussing the creation of these Sigma rules can be...

BypassCredGuard

BypassCredGuard - Credential Guard Bypass Via Patching Wdigest Memory Background Adam Chester @xpn wrote an article called "Exploring Mimikatz - Part 1 - WDigest" about memory patching to enable UseLogonCredential and make Wdigest cache cleartext credentials intrigued me. The wdigest.dll module...

Linux Distros Unpatched Vulnerability : CVE-2026-109253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming...

CVE-2026-70580

Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally...

CVE-2026-70580

A missing authentication vulnerability exists in a critical function within Windows Credential Guard . This flaw allows an authorized attacker to perform spoofing locally . The vulnerability has a HIGH base severity score of 8.8 and is categorized under CWE-306 . Official remediation is available...

Windows Credential Guard Spoofing Vulnerability

Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally...

CVE-2026-109253

A flaw was found in FreeRDP. When processing authentication data for Remote Credential Guard, the client checks data lengths before accounting for byte alignment padding. A malicious or compromised Remote Desktop Protocol RDP server can exploit this flaw by sending a crafted payload to a connecte...

CVE-2026-70580: Missing Authentication for Critical Function

Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally...

Microsoft Windows: CVE-2026-70580: Windows Credential Guard Spoofing Vulnerability

Missing authentication for critical function in Windows Credential Guard allows an authorized attacker to perform spoofing locally...

Microsoft Credential Guard Privilege Escalation

The vulnerability of Microsoft’s Credential Guard operating system is related to a memory reclamation error. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-109253

FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq message...

DEBIAN-CVE-2026-109253

FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq message...

CVE-2026-109253

FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq message...

CVE-2026-109253

FreeRDP versions 3.9.0 before 3.32.0 are vulnerable to an out-of-bounds read in the RDPEAR NDR scalar readers. The flaw occurs because the software checks value length before consuming alignment padding. A malicious or compromised RDP server can send crafted unaligned RDPEAR payloads, such as Cre...

EUVD-2026-97697

FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq message...

CVE-2026-109253 FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read

FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq message...

CVE-2026-109253 FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read

FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq message...