buffer overflow149

buffer overflowExploit Development

Two Bytes to RCE: Chaining Rift + PoolSlip into an ASLR-Independent nginx 1.30.0 Exploit

A two-bug nginx 1.30.0 chain: CVE-2026-42945 (Rift) heap overflow + CVE-2026-9256 (PoolSlip) heap over-read combine into an ASLR-independent remote system() call at…

oxfemale· Jul 13· 11 min ·149

buffer overflow164

buffer overflowDriver

CVE-2026-47291: Integer Overflow Remote Code Execution in Windows HTTP.sys

CVE-2026-47291 is a critical unauthenticated RCE vulnerability in Windows HTTP.sys caused by a 16-bit integer overflow in the buffer reference array growth…

oxfemale· Jul 10· 11 min ·164

ALPC64

ALPCbuffer overflow

CVE-2020-1027: Windows CSRSS Heap Buffer Overflow and Sandbox Escape

CVE-2020-1027 is a heap buffer overflow in the Windows CSRSS SxS assembly component. A missing bounds check on UNICODE_STRING.MaximumLength in an ALPC…

oxfemale· Jun 29· 9 min ·64

buffer overflow34

buffer overflowExploit Development

Overcoming Space Restrictions with Egghunters in Windows Exploit Development — Savant Web Server 3.1, Syscall & SEH Egghunters, Heap Staging

When a Windows stack overflow gives you ~250 bytes of crash-buffer space but a useful Meterpreter payload is 400+ bytes, the answer…

oxfemale· Jun 12· 54 min ·34

buffer overflow47

buffer overflowDebug

Defeating Windows DEP Using ROP Chains Leveraging VirtualAlloc

Uses manual Return-Oriented Programming (ROP) to chain existing code fragments and call VirtualAlloc, changing memory permissions to bypass Windows DEP and then…

oxfemale· Mar 2· 59 min ·47

ASM32

ASMbuffer overflow

ROP the ROM: Exploiting a Stack Buffer Overflow on STM32H5 in Multiple Ways

Article details exploiting a stack buffer overflow on an STM32H5. It demonstrates basic shellcode injection, then bypassing a non-executable stack (XN/MPU) using…

oxfemale· Feb 25· 9 min ·32