darksword-kexploit

DarkSword Kernel Exploit Reimplemented in Objective-C. Supposed to support iOS 15.0 - 26.0.1. Offsets hardcoded for 15.x? NOTE: THIS EXPLOIT WAS NOT DISCOVERED / LEAKED BY ME, THE ORIGINAL SOURCE FOR THE LEAK IS https://github.com/htimesnine/DarkSword-RCE THIS EXPLOIT IS ALSO COMPLETELY UNRELATED...

pe-signgen

pe-signgen Cross-version binary signatures and RVA offsets for Windows PE functions Overview pe-signgen is a tool for reverse engineers and security researchers that automatically generates: Binary signatures byte patterns with wildcards for unexported and exported functions RVA and file offsets...

CVE-2022-22057_SM-F926U

Fork Mi adaptación para el SM-F926U del exploit original aquí Muchísimas gracias a m-y-mo por descubrir el exploit y su extrema paciencia con todas mis preguntas para portar esto al SM-F926U y hacerlo utilizable He añadido un daemon de inicio libtimeline.so basado en código de Shizuku Añadí un...

cve-2018-12386

Firefox Sandboxed RCE Exploit CVE-2018-12386 Here is a simple exploit for the vulnerability CVE-2018-12386 found by Niklas Baumstark, Samuel Groß and Bruno Keith. This is mostly a PoC I did for fun, there is no sandbox bypass and it will only work on a given Linux setup where the offsets used by...

dezlock-dump

dezlock-dump Extrae todo de un juego Source 2 en ejecución Deadlock, CS2, Dota 2 y genera un SDK de C++ a prueba de parches que resuelve offsets en tiempo de ejecución. Sin valores codificados, sin actualizaciones manuales cuando el juego se parchea. Inicio rápido 1. Descarga desde Releases o...

-CVE-2018-0834-aab-aar

Reconocimiento a @reubensammut, eres una bestia, G. CVE-2018-0834 ejecución completa de código. incluye offsets estáticos, bypasses de cfg,dep,aslr : disfruta...

rmx3888-cve-2026-43499-config

CVE-2026-43499 Exploit Configuration for realme RMX3888 Device Information Brand/Model : realme RMX3888 Android Version : 16 SDK 36 Build ID : BP2A.250605.015 Kernel : Linux 6.1.141-android14-11-o-gffc54a6d2287 SoC : Qualcomm SM8650 Snapdragon 8 Gen 3 Architecture : ARM64 aarch64 Overview This...

CVE-2018-4121

CVE-2018-4121 - Exploit RCE de PoC de secciones Wasm de Safari por MWR Labs c 2018 Detalles este exploit de prueba de concepto solo apunta a Safari 11.0.3 13604.5.6 en macOS 10.13.3 17D47. compile el payload de su elección como un dylib con un constructor. ejecute python filetojsarray.py your.dyl...

how2heap

Educational Heap Exploitation This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases. You can run apt source libc6 to download the source code of the Libc you are using...

DEBIAN-CVE-2026-79592

An out-of-bounds read vulnerability exists in the xlsdumpSummary function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets...

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

EUVD-2026-75746

An out-of-bounds read vulnerability exists in the xlsdumpSummary function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets...

CVE-2026-79592

An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 , caused by insufficient validation of file-controlled OLE summary offsets. The CVSS 3.1 score is 7.5 (HIGH) with a network attack vector, low complexity, no privileges required, no user interaction, and ...

netbsd_hfs

NetBSD hfs local overflow Bug details: root@kitploit: sizet hfslibreadanodeoffsetsvoid inbytes, uint16t outoffsetarray void ptr; if inbytes == NULL || outoffsetarray == NULL return 0; ptr = inbytes; / The offset for record 0 which is the very last offset in the node is always equal to 14, the siz...

ntoskrnl-metadata

ntoskrnl-metadata Un script de IDA Python para extraer metadatos críticos del kernel de binarios de Windows ntoskrnl.exe. Esta herramienta extrae automáticamente RVAs de funciones y desplazamientos de la estructura EPROCESS necesarios para desarrollar exploits dirigidos a CVE-2026-40369 y otras...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001462)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001462 advisory. In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually...

CVE-2026-80839

In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject unrepresentable multicast TVLV offsets The network and transport header fields in struct skbuff are 16-bit offsets from skb-head, and U16MAX is reserved as the unset transport header value. batadvtvlvcallhandle...

Astra Linux – Vulnerability in sane-backends

A out-of-bounds read in SANE Backends before version 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, known as GHSL-2020-082...

Astra Linux – Vulnerabilities in Python 2.7, Python 3.11, Python 3.7

There is a defect in the CPython “tarfile” module that affects the “TarFile” extraction and entry enumeration APIs. The tar implementation processes tar archives with negative offsets without errors, which can lead to an infinite loop and deadlock during the parsing of maliciously crafted tar...

Astra Linux – Vulnerability in libheif

In Libheif 1.17.6, insufficient checks during the decoding of a heif file using ImageOverlay::parse can lead to out-of-bounds read and write operations when processing a file containing an overlay image with forged offsets...