PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Binary-searching into CVMServer

theori.io | vulnerability | #macos | #exploit | #cve-2022-26721 | #cvmserver | #uninitialized-memory | #binary-search
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2022-26721: a macOS CVMServer uninitialized-memory flaw found while diffing the CVE-2021-30724 patch, exploited via heap shaping, binary-search memory probing and dyld private-memory abuse.
Published
Collected

Related coverage

High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
Critical · vulnerability · github.com
CVE-2026-106173: Fortinet FortiSIEM gRPC Path Traversal to Pre-Auth RCE PoC
Provides a working pre-auth exploit against FortiSIEM instances exposing port 27918, escalating from gRPC path traversal to root-level remote command execution without credentials.
vulnerability · jfrog.com
[CVE-2026-90894] ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell
JFrog details CVE-2026-90894 in Parallels Desktop: a world-writable prl_disp_service socket, weak peercred auth, and tar argument injection let unprivileged local users execute code as root.
vulnerability · horizon3.ai
The Quiet Attack Path
See how attackers quietly exploit AD through enumeration, Kerberoasting, and AS-REP roasting—and why most SIEM and EDR tools fail to catch it.
vulnerability · horizon3.ai
CVE-2023-48788: Revisiting Fortinet FortiClient EMS to Exploit 7.2.X
Revisiting CVE-2023-48788, a SQL injection in Fortinet FortiClient EMS Server. This blog details bypassing several restrictions to achieve arbitrary command execution as SYSTEM.
vulnerability · horizon3.ai
Cisco IOS XE CVE-2023-20198: Deep Dive and POC
Previously, we explored the patch for CVE-2023-20273 and CVE-2023-20198 affecting Cisco IOS XE and identified some likely vectors an attacker might have used to exploit these vulnerabilities.
Back