CVE-2016-3308

利用 CVE-2016-3308 破坏 win32k 桌面堆 作者：@55-AA，2016年9月18日 介绍 桌面堆是一个由 win32k 使用的内核池，可以被用户态应用程序利用。这里我将详细描述如何实现一个可靠的利用，从而在内核中读写任意地址。本文及相关的分析基于 win7sp1x86（build 17842）环境。 漏洞 2016年8月9日，微软发布了 MS16-098。漏洞代码位于函数 win32k!xxxInsertMenuItem 中，函数原型如下： root@kitploit: BOOL xxxInsertMenuItem PMENU pMenu, UINT wIndex,...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: Un QWORD de más en el montón del escritorio En la compilación Insider de Windows 11 10.0.28020.2149, la asignación en modo usuario del montón del escritorio de Win32k exponía un puntero sin procesar del grupo del kernel de sesión en el desplazamiento 0x100. La lectura en sí es cas...

Exploit for CVE-2026-50416

CVE-2026-50416: a kernel pointer on every desktop, readable fr...

KB5095051: Windows 11 Version 26H1 Security Update (June 2026)

The remote Windows host is missing security update 5095051. It is, therefore, affected by multiple vulnerabilities - Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. CVE-2026-42909, CVE-2026-42913, CVE-2026-42985, CVE-2026-42992,...

CVE-2025-54211

InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2025-54209 InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

Microsoft Windows本地提权漏洞（CVE-2021-1732）

CVE-2021-1732: win32kfull xxxCreateWindowEx callback out-of-bounds Mar 25, 2021 • iamelli0t CVE-2021-1732 is a 0-Day vulnerability exploited by the BITTER APT organization in one operation which was disclosed in February this year123. This vulnerability exploits a user mode callback opportunity i...

Veeam Agent backup job fails with "Failed to call RPC function 'TestCompatible': Error code: 0x80070008. Cannot initialize COM runtime" error

Challenge A Veeam Agent backup job managed by the backup server fails with the following error: Processing Error: Failed to call RPC function 'TestCompatible': Error code: 0x80070008. Cannot initialize COM runtime. Cause When a backup job starts, Veeam Backup & Replication connects to the Veeam...

Microsoft Windows win32k - Using SetClassLong to Switch Between CS_CLASSDC and CS_OWNDC Corrupts DC

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1389&desc=6 Windows maintains a DC cache in win32kbase!gpDispInfo-pdceFirst. If you create multiple windows from a shared class while switching between CSOWNDC and CSCLASSDC, you c...

Job Fails to Start Due to Timeout Caused by Desktop Heap Allocation Failure

Article Applicability The timeout error displayed in Veeam Backup & Replication can be caused by various factors. This article explicitly addresses a scenario where the Windows OS experiences a 'heap allocation' failure. Please note that the solution provided in this article is only applicable if...

MS15-061 Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)

No description provided by source. include include / Exploiting MS15-061 with reverse engineering Win32k.sys by steps : 1: hook PEB callback Function 2: trigger vulnerability make proper Window to lead vulnerable function 3: replace fake object with NtUserDefSetText in Desktop heap inside PEB...