CVE-2022-38694_unlock_bootloader

CVE-2022-38694 An attacker with physical access to the device can overwrite a function pointer somewhere in the BootROM data section or a return address stored on the stack and execute their own code with BootROM privileges. For detailed information, read the article by NCC Group. 快速指路：...

CVE-2023-50965

💥 CVE-2023-50965 — Stack Buffer Overflow Exploit Linux Proof of Concept exploit for CVE-2023-50965 , demonstrating a stack-based buffer overflow leading to Remote Code Execution RCE on vulnerable systems without exploit mitigations enabled. This project was developed for security research and...

CVE-2021-27965

CVE-2021-27965 Proof of concept for CVE-2021-27965 Stack-based Buffer Overflow NOTE: I probably will not update this any further there is still a chance I will finish it. I currently have the ability to cleanly overwrite the instruction pointer, but I believe that this is enough to prove I have t...

CVE-2024-27398

CVE-2024-27398 CVE-2024-27398 PoC 📍 GDB 断点 root@kitploit: GNU gdb Ubuntu 12.1-0ubuntu122.04.2 12.1 Copyright C 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent...

CVE-2025-52413

CVE-2025-52413 — Particle Device OS BLE Buffer Overflow Discoverer : Golden Ticket Labs Vendor : Particle Date Assigned : August 12th 2025 MITRE Description A buffer overflow in the blecontrolrequestchannel.cpp component of Particle Device OS v5.6.0 enables arbitrary function pointer overwrite du...

cve-2025-2082-POV

CVE-2025-2082 – Function Pointer Overwrite PoV VCSEC-style This repository demonstrates a Proof of Vulnerability PoV simulating a critical memory corruption flaw inspired by CVE-2025-2082, discovered in Tesla's VCSEC Vehicle Controller Security component. The vulnerability allows an attacker to...

S5Late

S5Late Exploit atado de bootrom/DFU para iPod. Actualmente solo es compatible con Nano 7G; para admitir Nano 6G es necesario actualizar los offsets. Ejecución Pon tu iPod en modo DFU. Luego ejecuta: root@kitploit: ./S5Late hax 2024-12-15T23:11:34Z INFO S5Late We found an Apple Device in DFU mode...

DataInject-BOF

Data Inject BOF Una implementación en beacon object file de la prueba de concepto de inyección de procesos de mi entrada de blog Control Flow Hijacking via Data Pointers. Secuestra el flujo de control sobrescribiendo los punteros de función de Control Flow Guard de combase.dll que son llamados po...

CVE-2025-65018_Exploit_Challenge

CVE-2025-65018 CTF Challenge: "PNG Panic" This challenge is based on a real-world buffer overflow vulnerability in libpng specifically dealing with the simplified API pngimagefinishread when handling 16-bit interlaced images. 🚩 Challenge Goal You are provided with a vulnerable binary victim that...

optee-qemu

CVE-2021-44733: Fuzzing and exploitation of a use-after-free in the Linux kernel TEE subsystem Recently a use-after-free vulnerability was discovered in the Linux kernel TEE subsystem, up to and including version 5.15.11, and was assigned CVE-2021-44733 1. At a first glance it did not seem to be...

CVE-2026-9728

The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...

Astra Linux – Vulnerability in Linux

The fix for XSA-365 includes the initialization of pointers so that subsequent cleanup code would not use uninitialized or stale values. However, this initialization went too far and may, under certain conditions, also overwrite pointers that need to be cleaned up. The lack of cleanup would resul...

Wargame-Exploitation-Project

Exploit Script - Level 3 - Kỹ thuật: Buffer Overflow Trà...

CVE-2026-43629 llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore

llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the statereaddata function computes write size without overflow checking, allowing attackers with write access to the slotsavepath directory to corrupt heap memory. Attackers...

DEBIAN-CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

PT-2026-64382

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.1 Description A pre-authentication heap buffer overflow occurs during Encrypt-then-MAC ETM cipher negotiation. A malicious SSH server can corrupt heap metadata in a connecting client by sending a packet where the...

CVE-2026-47178 libheif has Heap Out Of Bounds Write in unci subsystem

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.19.0 through 1.21.2, a crafted HEIF file uncompressed unci codec, tiled, component-interleaved, 4:2:0 triggers a heap out-of-bounds write in libheif's uncompressed tile decoder. The write overwrites the C++ vtable pointer o...