---
id: 4673
title: "[CVE-2023-28218] Exploiting Windows Kernel Wild Copy With User Fault Handling (CVE-2023–28218)"
cve: CVE-2023-28218
source_domain: theori.io
source_url: "https://theori.io/blog/exploiting-windows-kernel-wild-copy-with-user-fault-handling-cve-2023-28218"
published_at: "2023-11-09T15:00:00Z"
tags: ["exploit", "windows-kernel", "heap-overflow", "cve-2023-28218", "afd-sys", "hexacon"]
phying_url: "https://phying.com/item/4673"
lang: en
---

# [CVE-2023-28218] Exploiting Windows Kernel Wild Copy With User Fault Handling (CVE-2023–28218)

## Summary

How Theori found and reliably exploited CVE-2023-28218, a heap overflow in Windows' afd.sys Fast I/O path, turning wild copy with user fault handling into a kernel exploit, detailed at Hexacon 2023.

## Intelligence Metadata

- **Sources:** theori.io
- **CVE:** CVE-2023-28218
- **Published:** 2023-11-09T15:00:00Z
- **Original:** https://theori.io/blog/exploiting-windows-kernel-wild-copy-with-user-fault-handling-cve-2023-28218
- **Phying News:** https://phying.com/item/4673