PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

NT OS Kernel Information Disclosure Vulnerability – CVE-2025-53136

crowdfense.com | vulnerability | Medium | CVE-2025-53136 | #information-disclosure | #race-condition | #kaslr | #cve-2025-53136 | #windows-kernel | #patch-analysis
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Analysis of CVE-2025-53136, a Windows kernel address leak introduced by the CVE-2024-43511 patch: a race condition in RtlSidHashInitialize leaks kernel pointers usable to defeat KASLR.
CVE
CVE-2025-53136
CVSS
5.5
Published
Collected

Related coverage

High · vulnerability · crowdfense.com
Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver – CVE-2025-53149
Technical deep-dive into CVE-2025-53149, a heap-based buffer overflow in the Windows Kernel Streaming WOW Thunk Service driver (ksthunk.sys).
blog · yeswehack.com
Dojo challenge #47 APICrash solution
Dojo #47: a race condition in a threaded TinyDB update inside a GraphQL backend triggers errors whose messages leak the flag — a classic information-exposure-through-error-message bug.
blog · projectzero.google
Using Binary Diffing to Discover Windows Kernel Memory Disclosure Bugs
A Project Zero post on using binary patch diffing to uncover Windows kernel memory disclosure bugs, including methodology, tooling, and notable findings from this approach.
vulnerability · crowdfense.com
Windows AppLocker Driver LPE Vulnerability – CVE-2024-21338
In-depth analysis of CVE-2024-21338, an untrusted pointer dereference in Windows' appid.sys (AppLocker) driver enabling kernel privilege escalation, covering root cause, SMEP/kCFG bypasses and POCs.
vulnerability · theori.io
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)
A deep dive into CVE-2024-27394, a TCP-AO use-after-free caused by incorrect RCU API usage in the Linux kernel, covering RCU internals, the patch, and the ExpRace technique for reliable triggering.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 6 — Windows Kernel LPE: Get SYSTEM
Final part of the N-day chain series: how CVE-2023-36802, a type-confusion flaw in the mskssrv.sys driver, was analysed and exploited to raise VMware privileges to SYSTEM on the host.
Back