Tag: lpe
30 entries tagged lpe, latest activity first.
- Linux kernel ZDI-CAN-33367: a public local root exploit for an skb_zerocopy page-cache write that gets past the Dirty Frag fix, with no CVE and no mainline fix, among six reports Trend Micro's ZDI copied to public lists, two of them ksmbd flaws scored CVSS 9.0
- CVE-2026-46300, Linux kernel: local privilege escalation via xfrm ESP-in-TCP ("Fragnesia"), listed by CISA as exploited and chained with the PHP2Shell flaws to reach root, PoC public
- Microsoft calls Nightmare Eclipse's six uncoordinated Windows zero-day releases "never justifiable"; the three May drops were fixed in June 2026
- Windows BitLocker "YellowKey" (CVE-2026-45585) and CTFMON "GreenPlasma" (CVE-2026-45586) zero-days: public PoCs in May, fixed in the June 2026 Windows updates
- ShieldBreak: a public proof-of-concept defeats Microsoft's July fix for the RoguePlanet Defender flaw, claims 100% reliability where the original was a coin flip, and now covers Windows Server 2025
- Chaotic Eclipse turns its zero-day drops on third-party security products: local privilege escalation in CrowdStrike Falcon and Avast, with working proof-of-concept code public; all three vendors have since remediated
- September 2026 Patch Tuesday: two actively exploited Windows privilege-escalation zero-days (CVE-2026-81963 Update Stack, CVE-2026-85880 ALPC)
- CVE-2026-43284 / CVE-2026-43500 Linux Dirty Frag: deterministic page-cache write to root through xfrm-ESP and RxRPC, public exploit, fixes released
- Windows Defender ships its own kernel write primitive: BTR.sys, the signed boot-time remediation driver, takes an encrypted job list from an alternate data stream and will delete or create any file or registry value asked of it
- LegacyHive: a public Windows technique that redirects a profile's Local AppData into the NT Object Manager namespace via offline hive edits, reproduced on fully patched systems
- Linux kernel bridge STP timer use-after-free, a control-flow hijack primitive with a published exploit, no CVE, and no confirmed stable backport
- WP2Shell: pre-auth RCE chain in stock WordPress core (CVE-2026-63030 + CVE-2026-60137), out-of-band 7.0.2 patch, exploited within days and KEV-listed
- CVE-2026-53359, Linux KVM/x86 "Januscape": shadow-MMU use-after-free enables guest-to-host VM escape on Intel and AMD
- CitrixBleed 2 (CVE-2025-5777) weaponised into a repeatable IAB kill chain ending in DragonForce ransomware (STAC3725)
- CVE-2026-50656: Microsoft Defender engine 'RoguePlanet' local privilege escalation now patched; NCSC-CH tracks the ongoing 'Nightmare Eclipse' zero-day series
- GhostLock (CVE-2026-43499), Linux kernel rtmutex use-after-free with a public, 97%-reliable root and container-escape exploit
- CVE-2026-43503, Linux kernel "DirtyClone": page-cache corruption via XFRM/IPsec skb cloning (working PoC)
- CVE-2026-46331, Linux kernel "pedit COW": out-of-bounds write in the tc act_pedit module (public weaponised PoC)
- Nightmare/Chaotic Eclipse zero-day wave; the Defender LPE now carries a CVE, a public PoC, and Microsoft's "Exploitation More Likely" rating, with no patch
- "RoguePlanet" Microsoft Defender zero-day: TOCTOU race in the scan engine yields a SYSTEM shell, no CVE, no patch
- Exodus Intelligence publishes working exploit for a one-character Linux kernel nf_tables use-after-free (CVE-2026-23111)
- Linux cgroups v1 release_agent container escape (CVE-2022-0492) re-enters active exploitation
- CVE-2026-32996 & CVE-2026-32997, Veeam Backup & Replication KB4852: LPE in Windows Agent, arbitrary file write in Linux appliance
- CVE-2026-46333 ssh-keysign-pwn: a 9-year ptrace race in the Linux kernel reaching root and SSH host keys
- CVE-2026-41091: exploited Microsoft Defender link-following privilege escalation to SYSTEM, with the CVE-2026-45498 Defender denial of service
- PinTheft: Linux kernel RDS zerocopy double-free (CVE-2026-43494) turned into a root exploit through io_uring fixed buffers, public PoC; V12 found RDS loaded by default only on Arch Linux among the distributions it tested
- DirtyDecrypt (DirtyCBC): public root exploit for a Linux kernel RxGK page-cache write, mapped to CVE-2026-31635, on kernels built with CONFIG_RXGK
- MiniPlasma: Chaotic Eclipse PoC turns the 2020 Windows Cloud Files driver flaw CVE-2020-17103 into a SYSTEM shell on patched Windows 11; June 2026 updates fix it
- AMD-SB-7052 / CVE-2025-54518: AMD Zen 2 op-cache corruption lets local code run instructions at a higher privilege, guest to host included (CVSS 7.3); OS updates on EPYC 7002, OEM BIOS updates on Ryzen
- CVE-2026-31431 Copy Fail: Linux kernel AF_ALG page-cache write gives any local user root on mainstream distributions, public exploit, CISA KEV-listed (CVSS 7.8)