cve-2026-29923

CVE-2026-29923 — pstrip64.sys Local Privilege Escalation A minimal proof-of-concept for CVE-2026-29923, a vulnerability in the pstrip64.sys kernel driver EnTech Taiwan PowerStrip ≤ 3.90.736 that allows an unprivileged user-mode process to escalate to NT AUTHORITY\SYSTEM. The Bug pstrip64.sys...

Eneio64-LPE

Opens a handle to the vulnerable driver 2. Maps physical memory into userspace 3. Opens a handle to the System process 4. Queries the SystemHandleInformation table of the current process for the obatined system handle leaking its EPROCESS address. 5. Walks System EPROCESS ActiveProcessLinks...

CVE-2025-7771

CVE-2025-7771 — ThrottleStop.sys Arbitrary Physical Memory R/W Full proof-of-concept for the TechPowerUp ThrottleStop.sys driver CVE-2025-7771. A signed, still-loadable kernel driver exposes unvalidated physical memory read and write through two IOCTLs. This repo turns that primitive into a worki...

ThrottleStopPPL

ThrottleStopPPL A proof-of-concept tool for managing Protected Process Light PPL protection levels on Windows Server 2022 by exploiting vulnerabilities in the ThrottleStop driver CVE-2025-7771. Overview This tool demonstrates privilege escalation through arbitrary physical memory read/write...

MSI_FeatureManager_CVE

KernCoreLib64.sys Vulnerability PoC Physical Memory and I/O Port Abuse for Privilege Escalation...

CVE-2025-7771

CVE-2025-7771 A simple PoC demonstrating the vulnerability in the ThrottleStop.sys driver, showcasing arbitrary physical memory read and write capabilities, as well as virtual-to-physical address translation using Superfetch. ⚡ Usage: 1. Register a service: Launch cmd.exe with Administrator...

CVE-2025-8061-Exploit

CVE-2025-8061 Exploit Overview Proof-of-Concept exploit for LnvMSRIO.sys Lenovo MSR I/O Driver, demonstrating arbitrary physical memory read/write and kernel memory access via Superfetch VA-to-PA translation. Driver Information Property| Value ---|--- Driver Name| LnvMSRIO.sys Device Name|...

CVE-2025-7771-Vulnerability-Exploration

🔓 ThrottleStop.sys Kernel Exploit — HVCI-Compatible Physical Memory Mapper CVE-2025-7771 — Arbitrary Physical Memory Read/Write via ThrottleStop.sys IOCTLs ⚠️ Disclaimer This project is published for educational and research purposes only. The goal is to demonstrate how a signed, trusted kernel...

throttlestop-exploit-rw

Physical Memory Mapper Research tool demonstrating physical memory access through virtual-to-physical address translation combined with vulnerable driver exploitation. Overview This project explores low-level Windows memory management by combining the superfetch technique for address translation...

ghostlock-s26

GhostLock CVE-2026-43499 for the Galaxy S26 CVE-2026-43499 ported to the Samsung Galaxy S26 series — Android 16 / GKI 6.12. One binary, three kernel lines, dynamic parameter matching at runtime: theoretically covers the whole S26 series without per-build compilation. Most GhostLock porting effort...

qiomem

Description Arbitrary physical memory read/write using Toshiba qiomem.sys from ring 3 only works upto 4GB physical addresses. Driver is distributed via Microsoft Update Catalog. Other variants. Not listed on Microsoft Vulnerable Driver List, no previous CVE alloted. first run acpi.exe to create t...

cve-2025-7771

CVE-2025-7771 — ThrottleStop.sys LPE Proof-of-concept for CVE-2025-7771. ThrottleStop.sys exposes two IOCTL handlers that allow arbitrary physical memory read/write with no access control — any admin process can read or write anywhere in physical RAM. Tested on Windows 10 22H2 and Windows 11 23H2...

Lenovo-CVE-2025-8061

CVE-2025-8061 is a privilege escalation vulnerability in Lenovo's LnvMSRIO.sys driver. The driver exposes IOCTL handlers that allow any user-mode process including unprivileged users to: Read/write arbitrary Model-Specific Registers MSRs Read/write arbitrary physical memory This gives a standard...

physmem2profit

Physmem2profit Physmem2profit can be used to create a minidump of a target host's LSASS process by analysing physical memory remotely. The intention of this research is to propose an alternative approach to credential theft and create a modular framework that can be extended to support other...

Silhouette

Silhouette By Gabriel Landau and Mark Mager at Elastic Security. From Hide Your Valuables — Mitigating Physical Credential Dumping Attacks presented at Shmoocon 2023. Slides here. Keeping LSA secrets out of physical memory Silhouette is a POC that mitigates the use of physical memory to dump...

CVE-2026-51585

realtek poc rt26cx21x64.sys exploit Realtek PCIe GbE/2.5GbE/5GbE family Overview OID 0xFF816871 maps the nic's mmio bar into the calling proc's virtual addr space, MmLockedPagesSpecifyCache, reachable from um via \.\RealTekCardGUID This IOCTL 0x0012C818 is gated by a registry value DrvMode=4 Once...

CVE-2026-80118

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disclosure in DirectIo64.sys, reachable by unprivileged local users through a single IOCTL with no caller-identity check. The handl...

CVE-2026-80114

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded ...

CVE-2026-80119

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a...

CVE-2026-80113

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to clear arbitrary bits at any physical memory address due to missing validation of the...