# Exploits

This is the line. Public class notes, your own lab binaries, licensed software you own. Not a friend's box. Not a r…

Last ReplygreyTuesday, 20:43

First file: race. Second file, after the patch: logic, because the race patch made a new assumption. Both were real…

Public, patched. The leak was the hint. The UAF was the bug. The patch is atomic and ordered. If you see a weird le…

flushoptMEMBERstarted 23 Aug 2026, 09:06

Last Replygotplt23 Aug 2026, 15:48

Yes still. A desktop app extracted a theme zip. Patched with a prefix check. I want test zips that are legal and me…

Last Replyserialize23 Aug 2026, 15:41

I still see 2012 heap writeups pasted into 2026 threads. Pool encoding exists. Your diagram does not. If you write …

fidbMEMBERstarted 27 Sep 2025, 08:11

Last Replypreflock21 Aug 2026, 23:03

CTF libc is not your production allocator. If you paste a CTF grooming diagram into a Windows pool thread, I will l…

mosesprimeSENIORvendorstarted 5 May 2026, 04:37

Last Replyidtpeek16 Aug 2026, 02:21

CVE, vendor URL, class in one sentence, hunt notes, link to this thread. I do not copy exploit rumors. Link to the …

dseflagMEMBERstarted 2 May 2026, 13:29

Last Replyasidroll11 Aug 2026, 06:14

Public n-day. Vendor was stating a file, then opening it again by name. Patch: open once, fstat the handle, use the…

Last Replyusbstall9 Aug 2026, 06:12

I reverse the patch. I write the class. 'Improved validation' is not a class. Vendors: one sentence with the actual…

Last Replymolot9 Aug 2026, 00:13

Because the next person will run them on a host. Hashes and links to the public corpus. Not files. If you attach a …

Last Replyrootkit_ivan6 Aug 2026, 18:08

The desktop got the patch. The printer firmware did not. Same class, different update story. Hunt by build and by d…

sleighMEMBERstarted 6 Oct 2025, 04:38

Last Replyshowregs6 Aug 2026, 03:43

Not a website. A desktop app with a JS shell. Same class. Patched by freezing the object they should have frozen. J…

dynsymMEMBERstarted 2 Aug 2026, 15:36

Last Replykaktus4 Aug 2026, 13:54

Fuzzer + public corpus. Crash. Vendor patched. I am posting the class, not the crashing file, because the crashing …

dsdtdumpMEMBERstarted 2 Apr 2026, 03:51

Last Replyksmmerge1 Aug 2026, 02:10

The upstream patched. Our tree did not. That is our CVE now, socially, even if the number stays upstream. Vendor bu…

isrdpcGUESTstarted 23 Jul 2026, 03:13

Last Replynnpflag29 Jul 2026, 20:53

Public, patched. Error path freed a buffer, success path used it. The patch nulls the pointer. Detection: look for …

pcodevmMEMBERstarted 19 Sep 2025, 10:28

Last Replyctorsold28 Jul 2026, 02:59

Desktop patched. Infotainment image did not. Same class, longer tail. Hunt images, not just desktops. The tail is w…

plthookMEMBERstarted 25 Jul 2026, 20:56

Last Replyvftable25 Jul 2026, 23:43

Hang in a decoder on a weird but legal file. We called it a bug, then we called it a timeout, then we capped the lo…

Last Replybeacon24 Jul 2026, 19:06

They patched the integer wrap with a saturating add. The function now loops until a watchdog. Crash became hang. A …

heavenMEMBERstarted 11 Sep 2025, 03:26

Last Replyrundown24 Jul 2026, 11:09

Internal thread said unexploitable. External researcher got a CVE anyway. We patched. The mail was a delay, not an …

rundownGUESTstarted 24 Jul 2026, 08:09

Last Replyzarya24 Jul 2026, 10:33

Yes still. OAuth return URL. Patched with an allow-list. This is on-topic because people still call it 'just phishi…

outstackGUESTstarted 24 Jul 2026, 00:38

Last Replytscskew24 Jul 2026, 03:13

The forgot-VM problem is worse on out-of-band because the process is 'someone saw the mail'. I hunt the old bytes, …

Last Replydispatch23 Jul 2026, 11:19

Struct sent to user, padding had stack residue. Patched with a zero. Hunt the missing RtlZeroMemory in old builds. …

dispatchGUESTstarted 23 Jul 2026, 08:19

Last Replylfence23 Jul 2026, 10:26

Not memory corruption. The function authorized object A and acted on object B. Patched. This belongs here because '…

Last Replypassive23 Jul 2026, 08:12

They probed twice and the second probe was the bug. The patch copies. Talk copies, not races you can win. If you as…

iocompleteGUESTstarted 22 Jul 2026, 09:24

Last Replyxdatabad22 Jul 2026, 10:51

Local, so 'who cares'. Then the tool ran elevated and the DB held tokens. Patched with a parameterized query. Care.…

xendMEMBERstarted 12 Feb 2026, 14:57

Last Replycancelrtn22 Jul 2026, 09:12

if (len > cap) { /* log */ } memcpy(...). The check was a comment. Second patch returned the error. Read the patch.…

Last Replyxsaveopt20 Apr 2026, 16:24

Wrapper took dest, destsz, src, count and then ignored destsz on a path. Patched. Wrappers are code. Review them li…

acpifacpMEMBERstarted 25 Mar 2026, 12:26

Last Replytestsign26 Mar 2026, 08:05

User-controlled format in a log helper. Patched. Log helpers are parsers. Treat them like parsers. No, I will not t…

lfencetmrMEMBERstarted 27 Feb 2026, 06:50

Last Replyalignas28 Feb 2026, 19:54

Advisory said unexploitable. A year later, a different allocator, a write. The class was always a write with homewo…

Microsoft patched the class in their driver. A 3rd-party driver still has the print. Hunt the print. Third-party is…

pauserepMEMBERstarted 24 Jan 2026, 18:26

Last Replykenjifw25 Jan 2026, 20:24

The check after the alloc is not a check. The patch moved it before. Hunt both if you have old and new. Order of ch…

Last Replybhdis21 Jan 2026, 21:37

tmpnam + open. Public. Patched with mkstemp. 1990s called, it wants its bug class back. If you write tmpnam in 2026…

External entities on by default. Patched by turning them off. Detection: the old default. XML parsers are guilty un…

iretqframeMEMBERstarted 2 Jan 2026, 19:15

Last Replycfgwatch3 Jan 2026, 15:08

Public appliance, patched. The helper concatenated a filename into system(). The patch is execve with argv. If your…

Last Replyhotpath28 Dec 2025, 10:35

The first advisory said crash. The second said info leak. Same bug, better understanding. Treat OOB read as a leak …

wowtebMEMBERstarted 16 Dec 2025, 16:40

Last Replyramoops17 Dec 2025, 04:06

Public kernel class. Fetch length, alloc, fetch again. Patch copies once. Hunt the second fetch in old builds. If y…

Last Replydmitrire5 Dec 2025, 05:51

Patched. The stub did not zero a token and sometimes leaked a handle-shaped value. Detection is a code pattern, not…

fastcallMEMBERstarted 30 Nov 2025, 22:49

Last Replykisystem3 Dec 2025, 18:09

size_t vs int. The compare looked fine in the decompiler until you noticed the int. Patched. Decompilers lie about …

Last Replydump_the_core20 Nov 2025, 18:58

Classic. The patch stores the index, not the pointer. Detection: look for the pointer cache in old builds. If you c…

disasmMEMBERstarted 11 Nov 2025, 20:25

Last Replygscookie13 Nov 2025, 10:16

realpath then concatenate. The concatenate reintroduced .. . Public, patched, embarrassing. Canonicalize last, or s…

forcefnMEMBERstarted 4 Nov 2025, 14:48

Last Replysysenter5 Nov 2025, 15:57

Public driver n-day. IOCTL from user, no device check, METHOD_NEITHER nostalgia. Patch added the check. Hunt old dr…

Public Chromium bug, patched. The advisory is enough to hunt the old object shape. It is not enough to write an exp…

Last Replyn0xturn18 Oct 2025, 04:16

Patched, public, vendor advisory is out. This thread is for defenders catching up. Classic integer wrap in a length…

kfullMEMBERstarted 26 Aug 2025, 17:51

Last Replyx64dbgbp29 Aug 2025, 13:07