CVE-2026-50416-writeup-and-poc

CVE-2026-50416: デスクトップヒープにおけるQWORD一つ分の過剰 Windows 11 Insiderビルド 10.0.28020.2149 において、Win32kデスクトップヒープのユーザーモードマッピングが、オフセット 0x100 に生のカーネルセッションプールポインタを露出していました。 この読み取り自体は、ほぼ攻撃的に小さなものです: ULONG64 leaked = ULONG64 desktopheap + 0x100; 私のテストセッションでは、次の値が返されました: 0xffffc600dcc00040...

WiseDelete

WiseDelfile ドライバー ラッパー 標準的な Windows API では削除できないファイルを削除するために、WiseDelfile64.sys カーネルドライバーを読み込み、必要なデバイスハンドシェイクを実行し、IOCTL 要求を発行する軽量な Windows ユーティリティです。 このプロジェクトは、CVE-2025-66680 を使用して、ドライバーを読み込んだ後にユーザーモードからドライバーのファイル削除機能を呼び出す方法を示しています。 機能 実行時に WiseDelfile64.sys を読み込み・アンロードします。...

CVE-2011-1237

CVE-2011-1237 2013년에 작성된 Windows 7용 CVE-2011-1237의 오래된 POC입니다. 이 취약점은 Tarjei Mandt@kernelpool가 발견했으며, 그의 논문 Kernel Attacks through User-Mode Callbacks에서 설명되었습니다. 이 POC에는 여러 항목이 하드코딩되어 있으며, 더 이상 작동하지 않는 Null 페이지를 호출합니다. 이 익스플로잇은 제 발표 A Look into the Windows Kernel에서 설명되었습니다. 셸코드가 수행하는 유일한 작업은 중단점을...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rcv: process: Fixed kernel gp leakage childregs represents the registers that are active for the new thread in the user context. For a kernel thread, childregs-gp is never used, as the kernel’s gp value is not touched by the...

Microsoft Windows UMPDDrvPlgBlt Improper Object Management Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the win32kfull...

Microsoft Windows UMPDDrvStretchBltROP Improper Object Management Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the win32kfull...

wtf v0.5.8

what the fuzz A distributed, code-coverage guided, cross-platform snapshot-based fuzzer designed for attacking user and or kernel-mode targets running on Microsoft Windows and Linux user-mode experimental!. Overview what the fuzz or wtf is a distributed, code-coverage guided, customizable,...

The vulnerability of the User-Mode Power Service (UMPS) in Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the User-Mode Power Service UMPS in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2026-12631

The Zephyr kernel validates the kthreadjoin and kthreadabort system calls declared syscall in include/zephyr/kernel.h through threadobjvalidate in kernel/thread.c. Its default switch branch is the access-denied path, taken when kobjectvalidate returns -EPERM the calling user thread was never...

CVE-2026-12631 Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel

The Zephyr kernel validates the kthreadjoin and kthreadabort system calls declared syscall in include/zephyr/kernel.h through threadobjvalidate in kernel/thread.c. Its default switch branch is the access-denied path, taken when kobjectvalidate returns -EPERM the calling user thread was never...

PT-2026-77335

Name of the Vulnerable Software and Affected Versions Zephyr kernel affected versions not specified Description An issue exists in the validation of the k thread join and k thread abort system calls via the thread obj validate function in kernel/thread.c. When k object validate returns an error...

EUVD-2026-56638

Insufficient granularity of access control in User-Mode Power Service UMPS allows an authorized attacker to elevate privileges locally...

CVE-2026-62721: Insufficient Granularity of Access Control

Insufficient granularity of access control in User-Mode Power Service UMPS allows an authorized attacker to elevate privileges locally...

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917

AnythingLLM up to version 1.15.0 has an account-recovery weakness in the unauthenticated recovery flow (server/utils/PasswordRecovery/index.js). The code uses recoverAccount() to deduplicate recoveryCodes before trimming, allowing a valid code submitted twice with different surrounding whitespace...

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

PT-2026-69986

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.0.0 through 1.15.0 Description The unauthenticated account-recovery flow in the server/utils/PasswordRecovery/index.js file uses the recoverAccount function to deduplicate recoveryCodes values before they are trimmed. Th...

CVE-2026-72917: Incorrect Behavior Order: Validate Before Canonicalize

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

USN-8618-1: Linux kernel vulnerabilities

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. CVE-2025-54518 Several security issues...