launchd-portrep

launchd-portrep launchd-portrep is an exploit for a port replacement vulnerability in launchd, the initial userspace process and service management daemon on macOS. By sending a crafted Mach message to the bootstrap port, launchd can be coerced into deallocating its send right for any Mach port t...

Damn_Vulnerable_C_Program

Note: file name has been changed from imgRead.c to dvcp.c, if you are watching videos, you will see imgRead.c but in github repo you will see dvcp.c, please use correct filename. Damn Vulnerable C ProgramDVCP My YouTube Channel: https://www.youtube.com/user/MrHardik05/featured?viewas=subscriber...

CVE-2022-21907-http.sys

CVE-2022-21907 - Double Free in http.sys driver CVE-2022-21907 - Double Free in http.sys driver Summary An unauthenticated attacker can send an HTTP request with an "Accept-Encoding" HTTP request header triggering a double free in the unknown coding-list inside the HTTP Protocol Stack http.sys to...

CVE-2019-11932

CVE-2019-11932 Double-Free bug in WhatsApp exploit poc. Note: Make sure to set the listner ip in exploit.c inorder to get shell nc -lvp 1337 or whatever port. and then compile. make or gcc -o exploit egiflib.c exploit.c then run ./exploit and save the content to .gif and send to victim. Source...

drmemory

Dr. Memory: el depurador de memoria Acerca de Dr. Memory Dr. Memory es una herramienta de monitoreo de memoria capaz de identificar errores de programación relacionados con la memoria, como accesos a memoria no inicializada, accesos a memoria no direccionable incluyendo fuera de las unidades de...

CVE-2019-11932

CVE-2019-11932 How a double-free bug in WhatsApp turns to RCE I’m going to share about a double-free vulnerability that I discovered in WhatsApp for Android, and how I turned it into an RCE. I informed this to Facebook. Facebook acknowledged and patched it officially in WhatsApp version 2.19.244...

CVE-2020-11932

CVE-2020-11932 Double-Free bug in WhatsApp exploit poc. Note: Make sure to set the listner ip in exploit.c inorder to get shell nc -lvp 1337 or whatever port. and then compile. make or gcc -o exploit egiflib.c exploit.c then run ./exploit and save the content to .gif and send to victim. Source...

CVE-2023-25136

OpenSSH CVE-2023-25136 Pre-Auth Double Free – Writeup and POC What is OpenSSH? OpenSSH is a popular tool used for secure communication and remote access. It was developed as a free, open-source implementation of the Secure Shell SSH communications protocol and is widely used for various...

CVE-2026-23918

CVE-2026-23918: Apache HTTP/2 Double-Free DoS CVE-2026-23918 | Apache HTTP Server 2.4.66 | CWE-415: Double Free | CVSS 8.8 | Fixed in 2.4.67 A double-free vulnerability in modhttp2 h2mplx.c allows remote attackers to cause a denial of service worker crash via rapid RSTSTREAM frames that trigger a...

CVE-2025-62215-POC

CVE-2025-62215 — Windows Token UAF SepTokenSidSharingEnabled Race Condition This repository is for educational and research purposes only. Overview A Use-After-Free vulnerability PoC that occurs in the SepTokenSidSharingEnabled optimization path of the Windows kernel. When NtDuplicateToken...

bincat

Introducción ¿Qué es BinCAT? BinCAT es un kit de análisis de código binario estático , diseñado para ayudar a los ingenieros inversos, directamente desde IDA o usando Python para automatización. Incluye: análisis de valores registros y memoria análisis de contaminación reconstrucción y propagació...

redis-poc

Redis Authenticated RCE stream NACK double free, TDigest & TopK module bugs Non-destructive RCE exploits for Redis 6.2.22, 7.4.9, 8.6.4 via the stream consumer-group shared-NACK double free a patch bypass of CVE-2026-25243, 8.8.0 via a TDigest heap-overflow in bundled RedisBloom, and 8.8.1 via a...

CVE-2026-25243

CVE-2026-25243 — Redis RESTORE zipmap double-free → remote code execution TL;DR. A malformed DUMP payload passed to RESTORE triggers a heap double-free in Redis's legacy hash-zipmap loader. Under default jemalloc the double-free is silent the server keeps running, which turns it into a controllab...

CVE-2025-62215_Windows_Kernel_PE

CVE-2025-62215 Exploit PoC Original code credit: https://github.com/dexterm300 🧨 Description This repository contains a proof-of-concept exploit for CVE-2025-62215 , a race condition vulnerability in the Windows kernel that can be triggered via concurrent manipulation of kernel object handles...

CVE-2026-89741

A flaw was found in the Linux kernel's media subsystem, specifically within the v4l2-dev component. This vulnerability arises from incorrect error handling in the videoregisterdevice function. If a device registration fails, the system attempts to free the same memory region twice, leading to a...

CVE-2026-89498

A flaw was found in OrangeFS within the Linux kernel. A local client, by sending a specially crafted readdir downcall with a declared trailersize exceeding the actual supplied bytes, can trigger a double-free vulnerability. This memory corruption issue can lead to a system crash, resulting in a...

CVE-2026-89563

A flaw was found in the ip6tunnel module of the Linux kernel. Incorrect handling of socket buffers skb during headroom reallocation in the ip6tnlxmit function can lead to a double-free vulnerability. This occurs when an error path is taken after the original skb has been consumed, but the caller...

CVE-2026-89582

A flaw was found in the bnx2x component of the Linux kernel. This flaw occurs due to a double free vulnerability within the bnx2xinitfirmware function's error handling path. Memory pointers are freed without being set to NULL, allowing the bnx2xreleasefirmware cleanup function to attempt freeing...

CVE-2023-5178

CVE-2023-5178 The exploit for CVE-2023-5178: NVMe-oF-TCP vulnerability, which is a logic error in NVMe-oF-TCP driver during the handle of corrupted Initialize Connection Request. It leads to racy double-free in kmalloc-96 , which can be exploited to gain LPEsee demo below. The exploit targets...

CVE-2026-89741

In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix error handling in videoregisterdevice" This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a. The intentions of that patch were good, but it doesn't work. The idea is that if deviceregister...