Loading vulnerability…
CVE-2026-0010 is an out-of-bounds write vulnerability in the Android DRM Manager Service Binder transaction handler, onTransact, in IDrmManagerService.cpp. The flaw results from a missing bounds check while processing a transaction and can be exploited locally to escalate privileges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small, focused exploit PoC for a local privilege escalation issue in debauchee Barrier 2.4.0 on Windows. It contains two files: a Python exploit script (Debauchee_Barrier_Privesc.py) and a README describing the vulnerability, reproduction steps, impact, and affected code paths. The exploit targets Barrier's unauthenticated IPC service exposed on 127.0.0.1:24801 by barrierd.exe running as LocalSystem. The script implements the minimal Barrier IPC protocol: it sends an IHEL hello packet with GUI client type 0x00, then an ICMD packet containing an arbitrary UTF-8 command plus a one-byte elevate flag. When elevate=1, the vulnerable service is described as launching the supplied command with SYSTEM privileges. The main exploit capability is local privilege escalation from a low-privileged local process to NT AUTHORITY\SYSTEM. The included payload is a visible demonstration command, cmd.exe -d x /k "start /max cmd.exe /k whoami", intended to pop a maximized SYSTEM command prompt and run whoami. The script also includes a cleanup/helper capability via clear_persisted_command(), which sends an empty command to overwrite the persisted Barrier command state so the payload is not replayed on future service restarts. Structurally, the Python file is straightforward: configuration constants define the target host/port and IPC message types; helper functions build the hello and command packets; _send() handles the TCP connection and transmission; run_poc() performs exploitation; clear_persisted_command() performs cleanup; and argparse provides CLI options for host, port, no-elevate testing, and clearing persisted state. Notable fingerprintable artifacts include the loopback endpoint 127.0.0.1:24801, the registry path HKLM\SOFTWARE\Barrier and value HKLM\SOFTWARE\Barrier\Command, and the protocol markers IHEL and ICMD. Overall, this is a real exploit PoC rather than a detector: it actively sends crafted IPC messages to trigger privileged command execution and demonstrates post-exploitation persistence behavior caused by the target application's own command replay logic.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.