cve-2014-0038

Local root exploit for CVE-2014-0038 Bug: The X86X32 recvmmsg syscall does not properly sanitize the timeout pointer passed from userspace. Exploit primitive: Pass a pointer to a kernel address as timeout for recvmmsg, if the original byte at that address is known it can be overwritten with known...

kernel: ALSA: ua101: reject mismatched capture/playback packet sizes

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture UA-101 USB audio driver. The driver does not validate that packet sizes and channel numbers match between capture and playback endpoints during device initialization. An attacker who connects a specially crafted USB...

CVE-2017-5123

CVE-2017-5123 Linux privilege escalation exploiting waitid syscall. The exploit is brought to you by @XeR0x2A and @chaignc from HexpressoTeam for educational purposes only. The bug was introduced the 2017-05-21 and fixed 2017-10-09, 4.14.0-rc4+ is known vulnerable. asciicast If you have a...

CVE-2024-2887

CVE-2024-2887 This is a short writeup for the CVE-2024-2887, which I used to claim V8CTF M123. When define more types than kV8MaxWasmTypes, which can be achieved by padding more types in RecGroup, the types index can be more than 20bits and then overflowed. Then two types can be considered same a...

kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. The driver fails to validate the size of Video BIOS VBIOS tables, allowing the calculated entry count to exceed the bounds of an internal array. A local attacker or compromised firmware image could exploit this flaw to trigger an...

kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. The driver fails to validate the size of Video BIOS VBIOS tables, allowing the calculated entry count to exceed the bounds of an internal array. A local attacker or compromised firmware image could exploit this flaw to trigger an...

chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia in Google Chrome

Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Chromium security severity: High...

xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes

A flaw was found in xorg-x11-server. In the Glamor 2D graphics acceleration module, a buffer allocation error occurs during color depth conversion when processing an image whose source dimensions exceed the destination dimensions. A local user can exploit this vulnerability to trigger an...

xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes

A flaw was found in xorg-x11-server. In the Glamor 2D graphics acceleration module, a buffer allocation error occurs during color depth conversion when processing an image whose source dimensions exceed the destination dimensions. A local user can exploit this vulnerability to trigger an...

RtlHijack

RtlHijack A repository with scripts to demonstrate alternative Read and Write primitives using Rtl functions the unintended way. RtlFillMemory.c RtlFillMemory takes three arguments: a pointer to the destination memory, the number of bytes to write, and a single byte value. Writes only a byte into...

xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes

A flaw was found in xorg-x11-server. In the Glamor 2D graphics acceleration module, a buffer allocation error occurs during color depth conversion when processing an image whose source dimensions exceed the destination dimensions. A local user can exploit this vulnerability to trigger an...

[SECURITY] [DSA 6618-1] openexr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6618-1 [email protected] https://www.debian.org/security/ Aron Xu November 11, 2026 https://www.debian.org/security/faq -...

kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

A flaw was found in the Linux kernel's AMD display driver. This vulnerability occurs when the driver processes malformed VBIOS Video Basic Input/Output System data. Specifically, unvalidated register counts in the VBIOS can lead to an out-of-bounds memory write during the driver's initialization...

CVE-2025-21479-FX5P

CVE-2025-21479 · OPPO Find X5 Pro PFEM00 temporary root RAM-only temp root for OPPO Find X5 Pro PFEM00 kernel 5.10.198-android12-9, ColorOS, locked bootloader via CVE-2025-21479 Adreno KGSL → KernelSU v3.3.0 LKM late-load. 中文：READMEzh.md Chain: KGSL physical R/W → disarm OEM guard, SELinux...

CVE-2026-20687-AppleJPEGDriver-UAF

CVE-2026-20687 — AppleJPEGDriver startDecoder Timeout UAF CVE-2026-20687 · Enfilade · enfilade.io Component: Kernel Impact: An app may be able to cause unexpected system termination or write kernel memory. Description: A use after free issue was addressed with improved memory management. —Apple...

CVE-2026-12166_CVE-2026-12167_CVE-2026-12168

Multiple Local Privilege Escalation Vulnerabilities in Little Orbit GFAC Driver GFACSysx64.sys | ---|--- CVE IDs| CVE-2026-12166, CVE-2026-12167, CVE-2026-12168 Vendor| Little Orbit Product| GamersFirst Anti-Cheat GFAC Driver GFACSysx64.sys Affected Versions| No version information is embedded in...

php-bypass-disable-functions

php-bypass-disable-functions Demo project how to bypass the disablefunctions security control of PHP on Linux, where processes can inspect and even write their own memory via the special /proc/self/map file via standard file operations open/seek/read/write. Tested on PHP 7.3.5, x8664 Linux See...

CVE-2017-16995

The latest version of Ubuntu Ubuntu 16.04 has a high-risk local privilege escalation vulnerability, numbered CVE-2017-16995. This vulnerability exists in the Linux kernel system that calls eBPF bpf2. When a user provides a malicious BPF program, the eBPF verifier module generates a calculation...

CVE-2026-38053---Remove-PPL

CVE-2026-38053---Remove-PPL BYOVD Remove PPL for 24H2 and 25H2 An arbitrary memory write in the handler for IOCTL 0x12C807 METHODNEITHER of Wise System Monitor v1.5.3.127 allows attackers to cause a remove PPL or Denial of Service DoS via a crafted input. Additional Information Tested on: Windows...

CVE-2026-120008

SAP NetWeaver Internet Graphics Service does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request to trigger an out-of-bounds memory write in a worker process. Successful exploitation could result in memory...