PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

ALPC You Later: CVE-2025-64721 Sandbox Escape Smashing The Heap Over IPC

depthfirst.com | vulnerability | Critical | CVE-2025-64721 | #rce | #vulnerability-research | #windows-security | #sandbox-escape | #heap-overflow | #alpc | #sandboxie | #cve-2025-64721
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Analysis of CVE-2025-64721, a Sandboxie sandbox escape: a missing bounds check in raw ALPC IPC allowed heap leakage and a 4GB heap smash, leading to SYSTEM-level code execution on Windows.
CVE
CVE-2025-64721
CVSS
10
Published
Collected

Related coverage

vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 2 — Windows Kernel LPE (a.k.a Chrome Sandbox Escape)
Part two of the chain: how CVE-2023-21674, a use-after-free in the Windows NT kernel involving ALPC, was exploited to escape the Chrome sandbox — the year’s first in-the-wild kernel bug.
Back