EUVD-2026-73015

Heap-based buffer overflow in Virtual Hard Disk VHD Miniport Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69541

A heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver allows an authorized (low-privilege) attacker to achieve local privilege escalation on an affected system. The vulnerability is scored CVSS 3.1: 7.8 (High) with impact to confidentiality, integrity, and availability all r...

CVE-2026-69582

CVE-2026-69582 is a buffer over-read vulnerability in the Windows Volume Manager Extension Driver , identified by Microsoft (CNA). An authorized local attacker with low privileges can exploit this flaw to elevate privileges locally, achieving high impact on confidentiality, integrity, and availab...

CVE-2026-69527

An out-of-bounds read vulnerability in the Windows USB Mass Storage Class Driver allows an authorized local attacker to disclose information. The CVSS v3.1 score is 5.5 (Medium) with a local attack vector, low privileges required, and high confidentiality impact. CISA's SSVC assessment indicates ...

EUVD-2026-72963

Use after free in Windows USB Audio Class driver usbaudio.sys allows an authorized attacker to elevate privileges locally...

CVE-2026-69390

CVE-2026-69390 is an out-of-bounds read vulnerability in Windows Spaceport.sys that allows an authorized attacker to locally disclose information . The Microsoft CNA rates it CVSS 5.5 (MEDIUM) with a local attack vector, low complexity, low privileges required, and a high impact on confidentialit...

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

Use after free in Reliable Multicast Transport Driver RMCAST allows an unauthorized attacker to execute code over a network...

Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability

Out-of-bounds read in Windows VOLSNAP.SYS allows an authorized attacker to elevate privileges over a network...

Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows USB Audio Class driver usbaudio.sys allows an authorized attacker to elevate privileges locally...

lenovo-dispatcher-poc

Lenovo Dispatcher PoC 这是一个基础的概念验证（PoC），用于利用 Lenovo Dispatcher 驱动程序（LnvMSRIO.sys）（CVE-2025-8061）。该漏洞由 Luis Casvella 发现（来源：https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061.html）。 这个 PoC 的主要思路是仅利用读写原语，从 ntoskrnl.exe 中窃取系统令牌（system token）。为此，PoC 使用...

CVE-2021-27965

CVE-2021-27965 用于通过生成系统 cmd 来利用 CVE-2021-27965 实现 LPE 的简单 PoC。 https://vulners.com/cve/CVE-2021-27965 在已签名的 MICSYS Windows 驱动程序（MsIo64.sys）中发现了一个问题，该问题可能导致整个本地系统受损。驱动程序的 ioctl 分发例程在 所有 IOCTL 代码中都存在基于栈的缓冲区溢出，并且还缺少对用户提供的缓冲区的验证。 IOCTL 任何人都可以创建句柄并向这些破坏 Windows 安全模型的 IOCTL 代码发起 ioctl 请求： 0x80102040 -...

PT-2026-87978

🚨 HIGH SEVERITY: CVE-2026-77904 CVSS 7.8 Heap-based buffer overflow in Windows Volume Manager Extension Driver enables local privilege escalation by authenticated attackers. Patch immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/fjuBA7sACZ...

cve-2021-43226PoC

CVE-2021-43226复现 环境 操作系统：Hyper-V上Win10 20H2 版本号19042.508，发现一个网站https://os.click/en, windows镜像比较全而且暂未发现后门 因为找到的PoC是用Visual Studio 2013编译，所以我也是用Visual Studio 2013静态链接程序的 漏洞 漏洞点在clfs.sys 里面的CClfsLogFcbVirtual::QueryLogFileInfo 函数中 clfs.sys在microsoft的Documentation中描述为 The Common Log File System CLFS...

cve-2022-21877

POC CVE-2022-21877 此仓库包含针对 CVE-2022-21877 的概念验证（POC），由 Quang Linh 发现，他任职于 STAR Labs。这是一个在 spaceport.sys 驱动程序中发现的的信息泄露漏洞。 相关的博客文章可在以下地址找到。 使用方法 要构建 POC，只需运行 .\build。 要运行它，你的机器上需要有一个可以分配 Tier 的存储池。在我的测试中，这意味着至少需要两个存储池：一个初始池和另一个池。这是因为初始池无法附加 Tier。 要获得必要的配置，你可以在虚拟机上设置 3...

CVE-2026-82325

A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messages...

cve-2025-7771

CVE-2025-7771 — ThrottleStop.sys 本地权限提升 CVE-2025-7771 的概念验证。ThrottleStop.sys 暴露了两个 IOCTL 处理程序，允许在没有任何访问控制的情况下任意读写物理内存 — 任何管理员进程都可以读取或写入物理 RAM 中的任意位置。 已在 Windows 10 22H2 和 Windows 11 23H2 x64 上测试。 我做了什么 首先将驱动程序二进制加载到 IDA Pro 中，以弄清其内部工作原理。找到了 IRPMJDEVICECONTROL 分发例程，并追踪到两个 IOCTL 代码： 0x80006498 —...

CVE-2026-81581

Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remo...

EUVD-2026-66985

Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remo...

CVE-2026-20908

Time-of-check time-of-use race condition for the IntelR NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result...

CVE-2026-20891

Improper authentication for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable local code execution. This result may...