Loading vulnerability…
CVE-2026-40369 is a Windows Kernel elevation-of-privilege vulnerability in ntoskrnl.exe, in the ExpGetProcessInformation code path reachable via NtQuerySystemInformation using SystemProcessInformationExtension (information class 253). The flaw is described as an untrusted pointer dereference that occurs when the caller supplies a zero-length output buffer. Under that condition, the ProbeForWrite validation becomes ineffective, allowing an attacker-controlled pointer to be passed into kernel processing without adequate validation. ExpGetProcessInformation reportedly sets a short-buffer status but continues execution and performs writes through the supplied pointer while iterating system process information. Public technical analysis describes the resulting primitive as a deterministic arbitrary kernel address increment affecting three adjacent DWORDs, corresponding to accumulated process, thread, and handle counts. This can be triggered by a local low-privilege attacker and is reported to be reachable even from restricted browser sandbox contexts.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This five-file C repository is a local Windows privilege-escalation exploit, consisting of exp.c as the executable entry point, exp.h for undocumented NT/kernel data structures and constants, and helper.c/helper.h for token forgery and SYSTEM-shell creation. README.md, written in Chinese, states that the approach was recorded with reference to CVE-2026-40369 browser-sandbox-escape research; however, the supplied code contains no browser-facing delivery, browser interaction, or network component. It is a post-compromise kernel privilege-escalation stage. The main program accepts an ntoskrnl.exe base address, repeatedly invokes NtQuerySystemInformation using undocumented information class 253 against attacker-selected addresses, and uses this behavior as a write primitive. It first attempts to alter the kernel Feature_RestrictKernelAddressLeaks state at ntoskrnl_base + 0xFC3B30 - 11, then queries SystemExtendedHandleInformation (class 0x40) to recover the kernel object address of its own process token. It writes into the token's SEP_TOKEN_PRIVILEGES region (+0x40 and +0x43) until SeCreateTokenPrivilege, SeTcbPrivilege, and SeImpersonatePrivilege are enabled. ForgeSystemToken then calls NtCreateToken to create a SYSTEM token with broad privileges; SpawnShell invokes CreateProcessWithTokenW to start cmd.exe in the interactive desktop/session. The hardcoded RVA and token offsets make this build-specific and dependent on the assumed kernel write primitive.
This repository is a small Windows local privilege escalation exploit project written in C++. It contains one main entry point (exp.cpp), a large helper implementation file (exp_tools.cpp), and a header (exp_tools.h). The README states that the ntoskrnl kernel base must be set manually, which matches the code path where the operator is prompted to enter the kernel base address. The exploit’s purpose is to elevate the current process to SYSTEM by abusing a vulnerable kernel code path involving NtQuerySystemInformation with the SystemHandleCountInformation class. The main program resolves NtQuerySystemInformation from ntdll.dll, detects the OS version, asks the user for the ntoskrnl kernel base, loads C:\Windows\System32\ntoskrnl.exe in user mode, derives the offset of SeDebugPrivilege and the EPROCESS token field, and then repeatedly calls SpwanCmdSystem() followed by NtQuerySystemInformation with a crafted pointer argument of SeDebugPrivilegeAddr - 1. This strongly suggests an arbitrary or near-arbitrary kernel write primitive intended to flip the kernel SeDebugPrivilege state and/or facilitate token manipulation. The helper code supports exploit setup and post-exploitation: enumerating processes, resolving kernel object pointers from handles via SystemExtendedHandleInformation, enumerating kernel modules via SystemModuleInformation, loading ntoskrnl.exe to pattern-scan for offsets, reading OS build/revision information, and spawning cmd.exe. The header defines many Windows-version-specific offsets for _EPROCESS token fields and PAGEDATA/SeDebugPrivilege locations, indicating the exploit is highly version-sensitive and designed for multiple Windows/Windows Server releases. There are no network callbacks or remote endpoints. The attack vector is purely local. The main fingerprintable artifacts are hardcoded Windows paths (cmd.exe and ntoskrnl.exe), use of ntdll.dll, and the specific native APIs/information classes used for kernel interaction. Overall, this is an operational local Windows kernel LPE exploit/privilege-manipulation tool rather than a scanner or detection script.
This repository contains a local Windows kernel privilege-escalation exploit for CVE-2026-40369, plus a basic primitive demonstrator and a Chrome renderer sandbox emulator. The repository has 5 files total: 4 code files and 1 README. Languages are C/C++ and Markdown. Structure: - `CVE-2026-40369/Basic_PoC/Basic-CVE-2026-40369.cpp`: minimal proof-of-concept showing the core bug. It dynamically resolves `NtQuerySystemInformation` from `ntdll.dll`, uses system information class 253 (`SystemProcessInformationExtension`), and passes a kernel pointer as the output buffer with length 0 to bypass `ProbeForWrite`. The stated effect is arbitrary kernel DWORD increments/additions at `[target+0]`, `[target+4]`, and `[target+8]`. This is a primitive demonstrator and may bugcheck the host if the address is invalid. - `CVE-2026-40369/Full_PoC/Full-CVE-2026-40369.cpp`: full exploit implementation. It resolves `NtQuerySystemInformationEx`, uses `SystemBuildVersionInformation` class 222, crafts fake version/query structures, manipulates kernel globals such as `CmpLayerVersionCount`, and appears to build a type-confusion-assisted kernel read/write workflow. The exploit then locates the current `EPROCESS`, reads the token via `EPROCESS_Token`, repeatedly increments token privilege-related fields, enables `SeDebug`, and attempts `InjectToWinlogon()` to obtain SYSTEM execution. - `CVE-2026-40369/full_poc_with_chrome_sandbox_emulator/Full-CVE-2026-40369.cpp`: essentially the same full exploit, compiled with `EMULATE_RENDERER_SANDBOX` for use with the included sandbox emulator. - `CVE-2026-40369/full_poc_with_chrome_sandbox_emulator/sandbox.c`: a substantial Chrome renderer sandbox emulator that recreates Chrome token restrictions, integrity lowering, job object behavior, and sandbox launch flow. It can launch a child with `--sandboxed`, run verification tests, then call the exploit (`exp()`) from a constrained context. - `README.md`: descriptive documentation, affected versions, impact, and defensive notes. Main exploit capabilities: 1. Trigger a vulnerable kernel path through native Windows syscalls. 2. Obtain an arbitrary kernel increment/write primitive. 3. Abuse build-version query structures to gain kernel memory disclosure / confusion primitives. 4. Discover kernel object addresses including the current process `EPROCESS`. 5. Read and manipulate token fields in kernel memory. 6. Enable elevated privileges such as SeDebugPrivilege. 7. Inject into `winlogon` to transition to SYSTEM-level execution. 8. Demonstrate exploitability even from a Chrome-like renderer sandbox using the emulator variant. There are no external network callbacks, C2 URLs, or remote endpoints in the provided code. The attack vector is strictly local. The code is a real exploit rather than a detector: it contains concrete syscall abuse, kernel structure manipulation, privilege modification, and process injection logic. Because the payload and post-exploitation steps are embedded and operational but appear somewhat hardcoded to specific offsets/build assumptions, the maturity is best classified as OPERATIONAL.
This repository contains a Windows local privilege escalation exploit for CVE-2026-40369, centered on NtQuerySystemInformation class 253 (SystemProcessInformationExtension). The bug is described as a ProbeForWrite bypass when SystemInformationLength is 0, allowing an attacker-supplied kernel pointer to reach ntoskrnl!ExpGetProcessInformation and be dereferenced/written during process enumeration. The primitive increments/adds three DWORDs at an arbitrary kernel address: process count at addr+0, total thread count at addr+4, and total handle count at addr+8. Repository structure: (1) README.md documents the vulnerability, crash details, affected Windows versions, and exploitability claims; (2) basic_poc/basic_poc.cpp is a minimal reproducer that dynamically resolves NtQuerySystemInformation from ntdll.dll and passes a hardcoded kernel address 0xffff800041424344 with length 0 to demonstrate the write primitive / BSOD behavior; (3) full_poc/full_poc.cpp is the main exploit chain, substantially more advanced than the basic PoC; and (4) full_poc_with_chrome_sandbox_emulator/ contains a near-identical full exploit plus sandbox.c, a Chrome renderer sandbox emulator used to show the exploit remains reachable from a restricted browser sandbox context. The full exploit appears operational rather than a simple crash PoC. From the visible code, it uses NtQuerySystemInformationEx with SystemBuildVersionInformation (222) and crafted structures to build a confusion/read primitive around CmpLayerVersions/CmpLayerVersionCount-related kernel data. It repeatedly calls a write_at() helper against kernel addresses derived from ntos_base and specific RVAs, searches for a confusion address, locates the current EPROCESS, reads the EPROCESS token, masks the EX_FAST_REF low bits, and then repeatedly increments token privilege-related offsets (token+0x42 and token+0x42+12). It then attempts InjectToWinlogon(), indicating the intended end state is elevated execution in a privileged process after enabling SeDebugPrivilege or equivalent token rights. The sandbox.c component is not an exploit itself but a realistic harness that recreates Chrome’s Windows renderer sandbox token model: lockdown and initial tokens, low/untrusted integrity, deny-only SIDs, restricting SIDs, privilege stripping, and various verification tests. Its purpose is to validate the exploit’s claim that the vulnerable syscall path is reachable even from a browser sandbox. No external network communication, C2, or remote endpoints are present. The exploit is entirely local and Windows-specific, relying on direct native API/syscall access and kernel structure manipulation. The most fingerprintable observables are the use of ntdll!NtQuerySystemInformation / NtQuerySystemInformationEx, the hardcoded example kernel address in the basic PoC, references to kernel offsets such as CmpLayerVersionCount and EPROCESS_Token, and the post-exploitation target winlogon.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
72 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An elevation of privilege vulnerability in the Windows Kernel.
A critical Windows kernel privilege escalation vulnerability in ntoskrnl.exe (ExpGetProcessInformation) that can allow unprivileged attackers, including from browser sandboxes, to gain SYSTEM privileges via a deterministic kernel memory manipulation primitive.
A Windows kernel elevation-of-privilege vulnerability caused by an untrusted pointer dereference in nt!ExpGetProcessInformation when NtQuerySystemInformation is called with a zero-length request, enabling arbitrary kernel memory writes, local privilege escalation, and browser sandbox escape.
A specific vulnerability identified as CVE-2026-40369, described in the content as related to escaping the browser sandbox.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.