PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2023-28218] Exploiting Windows Kernel Wild Copy With User Fault Handling (CVE-2023–28218)

theori.io | vulnerability | CVE-2023-28218 | #exploit | #windows-kernel | #heap-overflow | #cve-2023-28218 | #afd-sys | #hexacon
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How Theori found and reliably exploited CVE-2023-28218, a heap overflow in Windows' afd.sys Fast I/O path, turning wild copy with user fault handling into a kernel exploit, detailed at Hexacon 2023.
CVE
CVE-2023-28218
Published
Collected

Related coverage

High · vulnerability · crowdfense.com
Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver – CVE-2025-53149
Technical deep-dive into CVE-2025-53149, a heap-based buffer overflow in the Windows Kernel Streaming WOW Thunk Service driver (ksthunk.sys).
vulnerability · theori.io
Chaining N-days to Compromise All: Part 6 — Windows Kernel LPE: Get SYSTEM
Final part of the N-day chain series: how CVE-2023-36802, a type-confusion flaw in the mskssrv.sys driver, was analysed and exploited to raise VMware privileges to SYSTEM on the host.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 2 — Windows Kernel LPE (a.k.a Chrome Sandbox Escape)
Part two of the chain: how CVE-2023-21674, a use-after-free in the Windows NT kernel involving ALPC, was exploited to escape the Chrome sandbox — the year’s first in-the-wild kernel bug.
Critical · vulnerability · depthfirst.com
ALPC You Later: CVE-2025-64721 Sandbox Escape Smashing The Heap Over IPC
Analysis of CVE-2025-64721, a Sandboxie sandbox escape: a missing bounds check in raw ALPC IPC allowed heap leakage and a 4GB heap smash, leading to SYSTEM-level code execution on Windows.
vulnerability · bishopfox.com
Building an Exploit for FortiGate Vulnerability CVE-2023-27997
Bishop Fox walks through building a proof-of-concept exploit for CVE-2023-27997, a pre-auth heap buffer overflow in Fortinet's SSL VPN, covering the flawed length check and jemalloc heap grooming.
vulnerability · bishopfox.com
CVE-2023-27997 Is Exploitable, and 69% of FortiGate Firewalls Are Vulnerable
Bishop Fox built a working exploit for CVE-2023-27997, a FortiOS SSL VPN heap overflow allowing RCE, and found nearly 490,000 exposed interfaces via Shodan—roughly 69% unpatched.
Back