CVE-2022-25636

CVE-2022-25636 This is my exploit for CVE-2022-25636. I tested it against Ubuntu 21.10 with kernel 5.13.0-30. Works about 40% of the time, in the other cases you likely get a kernel panic. The exploit might corrupt important data on heap, after an unsuccessful attempt it's best to reboot...

CVE-2023-21716

CVE-2023-21716 Microsoft Word RTF Font Table Heap Corruption A vulnerability within Microsoft Office's wwlib allows attackers to achieve remote code execution with the privileges of the victim that opens a malicious RTF document. The attacker could deliver this file as an email attachment or othe...

CVE-2016-0040

CVE-2016-0040 This exploit builds upon SMMRootkit's 32Bit project https://github.com/Rootkitsmm/cve-2016-0040 which causes this vulnerability to trigger a BSoD with all 'a's in RCX and 'B's in RAX. It was ported to 64Bit Windows 7 SP1 and doesn't use the "mov rcx+06h, rax" instruction for inital...

CVE-2016-3308

Use CVE-2016-3308 corrupt win32k desktop heap author : @55-AA, Sept 18, 2016 Introduction Desktop heap is a kernel pool used by win32k, it can be exploited by user-mode application. Here I will describe in detail how to implement a reliable exploitation so that to read/write arbitrary address in...

CVE-2024-6387-analysis

CVE-2024-6387 OpenSSH Signal Race Condition Vulnerability Analysis Vulnerability Overview CVE-2024-6387 is a signal handling race condition vulnerability in OpenSSH versions 8.5p1 through 9.7p1, known as "regreSSHion". An attacker can continuously attempt within 6-8 hours to execute arbitrary cod...

CVE-2014-7911

CVE-2014-7911 POC for CVE-2014-7911 for Nexus5 Android 4.4.4r1 based on retme7, use different rop chain Info http://ele7enxxh.com/CVE-2014-7911-Detailed-Analysis-Of-Android-Local-Privilege-Escalation-To-System-Vulnerability.html Usage connect your phone via adb root@kitploit: adb push jni/expolit...

CVE-2024-38063-poc

Real POC published https://github.com/ynwarcs/CVE-2024-38063 and I have updated in my code as well, This can cause crash into your system so use VM or just learning thing, you can get RCE by making changes in the code. Usage iface Most probably this is enabled bydefault. Check the...

CVE-2021-30573

CVE 2021-30573 Google Chrome Vulnerabilities CVE-2021-30573 Use after free in GPU in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30573 Detail Vulnerable versions : The bug works in Google Chrome 91 or lower. It is patched in 92+...

CVE-2016-2334

Exploiting CVE-2016-2334 7zip HFS+ vulnerability hfsGenerator.py Script used to generate HFS+ file heap.js WinDbg js script. After loading script, setup allocation hook in the following way: bp ntdll!RtlAllocateHeap "pt "dx Debugger.State.Scripts.heap.Contents.handleRtlHeapAlloc;g"" Next you can...

CVE-2024-38063-Medium

This is a PoC somewhat unstable for CVE-2024-38063, RCE in tcpip.sys patched on August 13, 2024. requirements root@kitploit: pip3 install scapy usage Modify the fields in the script: iface - If you have multiple adapters, you need to choose which one to use to send packets. For example, "eth0" on...

CVE-2019-11933

CVE-2019-11933 Heap corruption in WhatsApp's media picker affecting WhatsApp for android before version 2.19.291 Background A GIF file is divided into segments, marked by a specific byte: Image 0x2C The image section describes a single frame in the GIF file, and contains information such as the...

CVE-2020-16947

CVE-2020-16947 This vulnerability occurs in Outlook 2019 16.0.13231.20262 installed on Windows 10 1909 x64 TLDR; I found this bug using winafl fuzzer. This bug occured when parsing html contents. if attacker successfully executes this exploit, it can lead to remote command execution. Details...

CVE-2026-25243

CVE-2026-25243 — Redis RESTORE double-free → remote code execution Verified against Rocky Linux 8.10, aarch64, Redis 8.6.2, jemalloc 5.3.0. Reference: https://www.zeroday.cloud/blog/redis-cve-2026-25243-deep-dive TLDR; Stable exploit, works against variety of OS distro and architecture. Executive...

CVE-2023-21716

CVE-2023-21716 — Microsoft Word RTF fonttbl Heap Corruption RCE Severity: Critical CVSS 9.8 Affected: Microsoft Word 2013 / 2016 / 2019 / 2021 unpatched Patch: Microsoft February 2023 Patch Tuesday Author: REGGYRAIDER Vulnerability Overview CVE-2023-21716 is a heap corruption vulnerability in...

EUVD-2026-82603

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompressArray methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned lengt...

EulerOS Virtualization 2.11.1 : libssh (EulerOS-SA-2026-3433)

According to the versions of the libssh package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for...

CVE-2026-93451 snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompressArray methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned lengt...

CVE-2026-93451

snappy-java through version 1.1.10.8 contains a buffer overflow in typed Snappy.uncompress*Array methods. The root cause is a length-handling mismatch: output arrays are allocated by dividing the uncompressed length by the element size, but the undivided (full) length is passed to the native code...

CVE-2026-73639

Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in readdirect8. With a tRNS chunk, readdirect8 adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count...

EUVD-2026-82492

Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in readdirect8. With a tRNS chunk, readdirect8 adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count...