Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

ALPC You Later: CVE-2025-64721 Sandbox Escape Smashing The Heap Over IPC

depthfirst.com | vulnerability | Critical | CVE-2025-64721 | #rce | #vulnerability-research | #windows-security | #sandbox-escape | #heap-overflow | #alpc | #sandboxie | #cve-2025-64721

Summary

Analysis of CVE-2025-64721, a Sandboxie sandbox escape: a missing bounds check in raw ALPC IPC allowed heap leakage and a 4GB heap smash, leading to SYSTEM-level code execution on Windows.
CVSS
10
Published
Collected

original ↗

Related coverage

  1. Chaining N-days to Compromise All: Part 2 — Windows Kernel LPE (a.k.a Chrome Sandbox Escape) (theori.io)
  2. Critical remote code execution in vm2, a widely used Node.js sandbox library (about.gitlab.com)
  3. Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase (hackerone.com)
  4. Exploiting Windows Kernel Wild Copy With User Fault Handling (CVE-2023–28218) (theori.io)
  5. K7 Antivirus: Named pipe abuse, registry manipulation and privilege escalation (CVE-2025-67826) (blog.quarkslab.com)
  6. Building an Exploit for FortiGate Vulnerability CVE-2023-27997 (bishopfox.com)

back