Loading vulnerability…
CVE-2018-7249 is a use-after-free vulnerability in the secdrv.sys driver as shipped with Microsoft Windows Vista, Windows 7, Windows 8, Windows 8.1 (prior to KB3086255), and Macrovision SafeDisc. The vulnerability arises from a race condition triggered by two carefully timed calls to IOCTL 0xCA002813, which can result in a use-after-free scenario. This allows an unprivileged attacker to execute arbitrary code in kernel mode.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a working proof-of-concept (PoC) exploit for CVE-2018-7249, a local privilege escalation vulnerability in the secdrv.sys driver as shipped with Microsoft Windows Vista, 7, 8, 8.1 (prior to KB3086255), and Macrovision SafeDisc. The exploit is implemented in C++ (NotSecDrv/NotSecDrv.cpp) and uses a custom shellcode (shellcode.asm) to steal the SYSTEM process token and assign it to cmd.exe, effectively granting SYSTEM privileges to the attacker. The exploit works by racing two IOCTL calls (0xCA002813) to the device file \\.\secdrv, triggering a use-after-free condition in the driver. The code allocates and frees memory chunks in the Windows PagedPool, sprays the pool to control allocation, and injects shellcode into a fake chunk. The shellcode is executed in kernel mode when the race is won, resulting in privilege escalation. The repository is structured as a Visual Studio C++ project, with the main exploit logic in NotSecDrv/NotSecDrv.cpp and the privilege escalation shellcode in shellcode.asm. The README.md provides detailed technical background, exploitation steps, and references to related vulnerabilities (including CVE-2018-7250, an info leak in the same driver). No network endpoints are involved; the attack is purely local and targets the device file interface of the vulnerable driver.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.