CallbackHell

CallbackHell Exploit for CVE-2021-40449 Win32k - LPE CallbackHell Description Technical Writeup PoC References Description CVE-2021-40449 is a use-after-free in Win32k that allows for local privilege escalation. The vulnerability was found in the wild by Kaspersky. The discovered exploit was...

CVE-2019-1215

CVE-20190-1215 ws2ifsl.sys UAF exploit for Windows 10 19H1 x64 This exploit uses the recently patched use after free vulnerability CVE-2019-1215 in ws2ifsl.sys to achieve local privilege escalation. The exploit targets Windows 10 19H1 1901 x64 and demonstrates how to bypass kASLR, kCFG and SMEP...

CVE-2026-12387

CVE-2026-12387 is a Use After Free vulnerability in Arm Mali GPU Kernel Drivers spanning three architectures: Bifrost , Valhall , and Arm 5th Gen GPU Architecture . A local non-privileged user process can perform valid GPU memory processing operations to access already freed memory. Affected driv...

CVE-2026-12285

CVE-2026-12285 is a Use After Free vulnerability in Arm Ltd GPU kernel drivers, specifically affecting the Bifrost , Valhall , and Arm 5th Gen GPU Architecture kernel drivers. A local non-privileged user process can perform valid GPU memory processing operations to access already freed memory. Af...

CVE-2026-11891

A Use After Free vulnerability exists in Arm Ltd's Valhall GPU Userspace Driver and Arm 5th Gen GPU Architecture Userspace Driver , affecting versions r46p0 through r49p5 , r50p0 through r54p3 , and r55p0 . The flaw allows a non-privileged user process to perform valid GPU processing operations—i...

CVE-2026-9034

CVE-2026-9034 is a Use After Free vulnerability in Arm Mali GPU Userspace Drivers affecting three architectures: Bifrost (r42p0–r49p5, r50p0–r51p0, r54p1–r54p3), Valhall (r42p0–r49p5, r50p0–r54p3, r55p0), and Arm 5th Gen GPU Architecture (r42p0–r49p5, r50p0–r54p3, r55p0). A non-privileged user pr...

CVE-2026-7477

CVE-2026-7477 is a Use After Free vulnerability in Arm Ltd Mali GPU Kernel Drivers, specifically the Bifrost , Valhall , and 5th Gen GPU Architecture drivers. A local non-privileged user process can perform valid GPU memory processing operations to access already freed memory. Affected version ra...

CVE-2026-7476

CVE-2026-7476 is a Use After Free vulnerability in Arm Ltd Bifrost , Valhall , and 5th Gen GPU Architecture Kernel Drivers . A local non-privileged user process can perform improper GPU memory processing operations to access already freed memory. Affected versions: Bifrost r49p3–r49p5, r51p0, r54...

CVE-2026-5729

CVE-2026-5729 is a Use After Free vulnerability in the Arm Ltd Valhall GPU Kernel Driver and Arm 5th Gen GPU Architecture Kernel Driver , affecting versions r50p0 through r54p3 and r55p0 . A local non-privileged user process can perform valid GPU processing operations to access already freed memo...

CVE-2026-0001

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory. This issue affects...

EUVD-2026-72793

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory. This issue affects...

CVE-2026-0001 Mali GPU Kernel Driver allows access to already freed memory

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory. This issue affects...

teamspeak3-vulnerabilities

TeamSpeak 3 Server - Proof of Concept Exploits This repository contains proof of concept code for three vulnerabilities CVE-2026-4390, CVE-2026-4391 and CVE-2026-4392 discovered in the TeamSpeak 3 server 3.13.7. All findings were responsibly disclosed to TeamSpeak and published in our advisory. F...

CVE-2022-41218

Introduction This vulnerability is a race condition vulnerability that occurs in drivers/media/dvb-core/dmxdev.c. Therefore, a race condition may occur in the usb device driver using this dmxdev. This vulnerability could be used to trigger 3 UAFs. Vulnerability 1. vmalloc UAF write First, the...

gsscred-move-uaf

GSSCred-move-uaf The com.apple.GSSCred XPC service, which runs as root on macOS and iOS, does not properly implement the "move" command, leading to a use-after-free condition in the doMove function. The GSSCred service can be reached from within the default application sandbox on iOS. This progra...

rootsh

rootsh rootsh is a local privilege escalation targeting OS X Yosemite 10.10.5 build 14F27. It exploits CVE-2016-1758 and CVE-2016-1828, two vulnerabilities in XNU that were patched in OS X El Capitan 10.11.4 and 10.11.5. rootsh will not work on platforms with SMAP enabled. CVE-2016-1758...

CVE-2020-27786-Kernel-Exploit

CVE-2020-27786 Kernel Exploit Details You can find full details and explaination here: https://1day.dev/notes/Linux-Kernel-n-day-exploit-development TL;DR The vulnerability is a Race Condition that causes a write Use-After-Free. The race window has been extended using the userfaultd technique...

CVE-2026-42978-PoC-Research

CVE-2026-42978 PoC & Research — Windows Push Notifications Use-After-Free Race condition in Windows Push Notifications service WpnService that runs as NT AUTHORITY\SYSTEM. An attacker with local access can trigger a use-after-free during platform shutdown and potentially elevate privileges. CVE:...

CVE-2026-79603

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...

vsock_poc

vsockpoc Investigating the bug behind CVE-2021-26708 This repo contains a small writeup about CVE-2021-26708, and how this bug can be turned into a Use After Free write primitive. The PoC here is not a full exploit, but just my harness I used when trying to investigate this bug. It can successful...