827 matches found
netbsd_hfs
NetBSD hfs local overflow Bug details: sizet hfslibreadanodeoffsetsvoid inbytes, uint16t outoffsetarray void ptr; if inbytes == NULL || outoffsetarray == NULL return 0; ptr = inbytes; / The offset for record 0 which is the very last offset in the node is always equal to 14, the size of the node...
dezlock-dump
dezlock-dump Extracts everything from a running Source 2 game Deadlock, CS2, Dota 2 and generates a patch-proof C++ SDK that resolves offsets at runtime. No hardcoded values, no manual updates when the game patches. Quick Start 1. Download from Releases or build from source 2. Launch your game —...
darksword-kexploit
DarkSword Kernel Exploit Reimplemented in Objective-C. Supposed to support iOS 15.0 - 26.0.1. Offsets hardcoded for 15.x? NOTE: THIS EXPLOIT WAS NOT DISCOVERED / LEAKED BY ME, THE ORIGINAL SOURCE FOR THE LEAK IS https://github.com/htimesnine/DarkSword-RCE THIS EXPLOIT IS ALSO COMPLETELY UNRELATED...
cve-2018-12386
Firefox Sandboxed RCE Exploit CVE-2018-12386 Here is a simple exploit for the vulnerability CVE-2018-12386 found by Niklas Baumstark, Samuel Groß and Bruno Keith. This is mostly a PoC I did for fun, there is no sandbox bypass and it will only work on a given Linux setup where the offsets used by...
ntoskrnl-metadata
ntoskrnl-metadata An IDA Python script for extracting critical kernel metadata from Windows ntoskrnl.exe binaries. This tool automatically extracts function RVAs and EPROCESS structure offsets required for developing exploits targeting CVE-2026-40369 and other kernel vulnerabilities. Purpose This...
how2heap
Educational Heap Exploitation This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases. You can run apt source libc6 to download the source code of the Libc you are using...
CVE-2022-22057_SM-F926U
Fork My adaptation for the SM-F926U from the original exploit here HUGE thanks to m-y-mo for discovering the exploit and his extreme patience with all my questions to port this to SM-F926U and make it useable I've added a startup daemon libtimeline.so based on code from Shizuku Added a dirty tric...
-CVE-2018-0834-aab-aar
Shoutout to @reubensammut, u a beast G. CVE-2018-0834 full code execute. include static offsets, bypasses cfg,dep,aslr : enjoy...
pe-signgen
pe-signgen Cross-version binary signatures and RVA offsets for Windows PE functions Overview pe-signgen is a tool for reverse engineers and security researchers that automatically generates: Binary signatures byte patterns with wildcards for unexported and exported functions RVA and file offsets...
rmx3888-cve-2026-43499-config
CVE-2026-43499 Exploit Configuration for realme RMX3888 Device Information Brand/Model : realme RMX3888 Android Version : 16 SDK 36 Build ID : BP2A.250605.015 Kernel : Linux 6.1.141-android14-11-o-gffc54a6d2287 SoC : Qualcomm SM8650 Snapdragon 8 Gen 3 Architecture : ARM64 aarch64 Overview This...
CVE-2018-4121
CVE-2018-4121 - Safari Wasm Sections POC RCE Exploit by MWR Labs c 2018 Details this proof of concept exploit targets Safari 11.0.3 13604.5.6 on macOS 10.13.3 17D47 versions only. compile the payload of your choice as a dylib with a constructor run python filetojsarray.py your.dylib payload.js...
CVE-2024-58399
llama.cpp before b2731 contains an out-of-bounds read vulnerability in llamamodelloader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the...
UBUNTU-CVE-2024-58399
llama.cpp before b2731 contains an out-of-bounds read vulnerability in llamamodelloader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the...
CVE-2024-58399
The llama.cpp library (versions prior to b2731 ) contains an out-of-bounds read vulnerability within the llama_model_loader component. An attacker can exploit this by providing a crafted or truncated GGUF model file containing arbitrary 64-bit tensor offsets. This allows the attacker to read memo...
CVE-2024-58399 llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets
llama.cpp before b2731 contains an out-of-bounds read vulnerability in llamamodelloader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the...
EUVD-2024-55826
llama.cpp before b2731 contains an out-of-bounds read vulnerability in llamamodelloader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the...
CVE-2024-58399 llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets
llama.cpp before b2731 contains an out-of-bounds read vulnerability in llamamodelloader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the...
CVE-2024-58399
llama.cpp before b2731 contains an out-of-bounds read vulnerability in llamamodelloader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the...
PT-2026-125540
llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama model loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash t...
