[1day-1line] CVE-2026-40369: Arbitrary Kernel Address Increment LPE/Sandbox Escape Vulnerability Caused by Untrusted Pointer Dereference in Windows Kernel(ntoskrnl.exe)
Hello, this is banda.
Today's 1day-1line covers an LPE/Sandbox Escape vulnerability in the Windows Kernel. In the NtQuerySystemInformation Class 253 path, Length=0 can bypass pointer validation and trigger a limited 12-byte kernel write primitive at an attacker-controlled kernel address, potentially leading to SYSTEM privilege escalation even from restricted environments such as a browser renderer sandbox.
Please refer to the blog post for more details!
https://t.co/wUPADuCioQ
New entry added to the #LOLBAS Project:
Proxy execution via system-native scp.exe. Takes any remote destination, doesn't actually have to run an SSH server.
👉 https://t.co/jLCiaB1fuM
Thanks @BinFault
One of the latest and most notable Windows privilege escalation vulnerabilities is CVE-2025-62215 in the Windows Kernel - https://t.co/3BV6DBr20n
The flaw is a race condition caused by improper synchronization when multiple threads concurrently access shared kernel resources. By carefully winning this race, a local authenticated attacker can manipulate kernel state during execution and cause the operating system to perform privileged operations on behalf of the attacker. Successful exploitation allows escalation from a low-privileged user account to SYSTEM privileges, providing complete control over the affected machine.
Because race-condition bugs are often difficult to exploit reliably yet highly impactful when successful, CVE-2025-62215 attracted significant attention after Microsoft confirmed it was being actively exploited in the wild. The vulnerability was addressed in Microsoft's November 2025 security updates by correcting the synchronization logic and preventing unsafe concurrent access to the affected kernel resources.
The exploit has been tested in Windows 11 (Official channel + Canary) and Windows 10 with june 2026 patch installed. The PoC however does not work in Windows Server since standard users cannot mount an ISO image
https://t.co/bLQ1KWeUiB
We spent almost 2 years seeing this disclosure through… and then accidentally forgot to post it here. 😅
Never gonna give you up.
Never gonna let you down.
Never gonna run around and forget the advisory.
CVE-2026-41873 is now public:
https://t.co/oLFwiOCMfI
MAD Bugs: Discovering a 0-Day in Zero Day
Here’s how I used Claude to find and patch a radare2 0-day on my first day at @calif_io.
https://t.co/sAkSdMS0gh
Exploit Demo & Analysis Article by 78ResearchLab(@78_lab)
CVE-2026-20817 : Windows Error Reporting(WER) Service Elevation of Privilege Vulnerability
https://t.co/x3x8XInNQU
#CVE_2026_20817#LPE#Windows
The Great VM Escape: ESXi Exploitation in the Wild
VMware:CVE-2025-22226+CVE-2025-22224+CVE-2025-22225
https://t.co/x98bSiGuBY
Key:
When vmci.sys is loaded, it owns the VMCI adapter and actively uses these same I/O ports. Two drivers cannot safely share the same hardware, if both attempt to send commands simultaneously, it would corrupt the device state and crash the system. By disabling vmci.sys first, the exploit gains exclusive access to the VMCI hardware.