Exploit Development205 CVE-2026-58629 is a double-fetch bug in the Windows graphics kernel (dxgkrnl). When D3DKMTCreateAllocation rolls back a failed create, it re-reads a user-controlled…
buffer overflow164 CVE-2026-47291 is a critical unauthenticated RCE vulnerability in Windows HTTP.sys caused by a 16-bit integer overflow in the buffer reference array growth…
Exploit Development81 A data-only technique that hijacks the x64 Interrupt Descriptor Table (IDT) to achieve kernel code execution on a fully hardened Windows 11…
Containers70 A deep technical walkthrough of ipv6_frag_escape, a public proof-of-concept exploit that converts a Linux kernel IPv6 fragmentation linear overflow into a reliable…
kernel92 A deep technical walkthrough of how Windows on ARM (WoA) discovers, initializes and dispatches interrupts through the Generic Interrupt Controller (GIC) —…
Exploit Development75 CVE-2026-40369 is an unprivileged arbitrary 12-byte kernel write in nt!ExpGetProcessInformation, reachable from Chrome/Edge/Firefox renderer sandboxes via NtQuerySystemInformation. A walk through the unchecked…
Exploit Development55 CVE-2018-8611 is a race-condition LPE in the Windows Kernel Transaction Manager (KTM), originally caught in the wild by Kaspersky’s AEP in October…
Exploit Development62 CVE-2024-1065 is a physical-page use-after-free in the ARM Mali GPU kernel driver. Because the freed page lands in MIGRATE_MOVABLE, Dirty Pagetable and…
Exploit Development49 CVE-2021-1732 is a Win32k local privilege escalation in win32kfull.sys. By flipping the 0x800 bit on tagWND with NtUserConsoleControl and returning a fake…
kernel82 A defender-side surface map of Windows kernel/user-mode covert channels — mailslots and ALPC, firmware-table providers and WNF, dispatch tables and writable .data…
kernel57 Walk-through of Lukas Maar’s page-level use-after-free in the Linux kernel’s QAIC (Qualcomm AI Accelerator) DRM driver: the missing VMA boundary check in…
kernel50 A walk-through of zolutal’s revival of the 2017 Project Zero “native_write_cr4” trick on a modern Linux kernel with CR Pinning enabled. The…
