Understanding Group Policy Privilege Escalation in CVE-2020-1317

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.

A Google Project Zero blog post examining a Windows privilege escalation technique involving dangling COM object registrations, which Microsoft addressed in a recent security update.

Write-up of CVE-2025-38236, a Linux kernel bug reachable from a compromised Chrome renderer via MSG_OOB socket handling, escalating renderer code execution into kernel privileges.

/* latin */ @font-face { font-family: 'Consolas'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/l/font?kit=X7nm4bA-A_-9jbjWaza9xMk&skey=3d1eb1871fcc58a1&v=v20) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD; } @import url('https://themes.googleusercontent.com/fonts/css?kit=lhDjYqiy3mZ0x6ROQEUoUw'); .post-body{ul.lst-kix_wl1qmy9tv69d-1{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-0{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-8{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-7{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-6{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-5{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-4{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-3{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-2{list-style-type:none}.lst-kix_vvah8cp3zgua-1>li:before{content:"\0025cb "}.lst-kix_kan00gftou8h-7>li:before{content:"\0025cb "}.lst-kix_a41x0ya2xyd3-6>li:before{content:"\0025cf "}.lst-kix_a41x0ya2xyd3-8>li:before{content:"\0025a0 "}.lst-kix_vvah8cp3zgua-0>li:before{content:"\0025cf "}.lst-kix_kan00gftou8h-4>li:before{content:"\0025cb "}.lst-kix_kan00gftou8h-8>li:before{content:"\0025a0 "}.lst-kix_a41x0ya2xyd3-3>li:before{content:"\0025cf "}.lst-kix_a41x0ya2xyd3-7>li:before{content:"\0025cb "}.lst-kix_a41x0ya2xyd3-4>li:before{content:"\0025cb "}.lst-kix_kan00gftou8h-5>li:before{content:"\0025a0 "}.lst-kix_kan00gftou8h-6>li:before{content:"\0025cf "}.lst-kix_a41x0ya2xyd3-5>li:before{content:"\0025a0 "}ul.lst-kix_h07r6gi9x3gp-0{list-style-type:none}.lst-kix_h07r6gi9x3gp-7>li:before{content:"\0025cb "}ul.lst-kix_40ztqamj21pm-1{list-style-type:none}ul.lst-kix_40ztqamj21pm-0{list-style-type:none}.lst-kix_vkloremw4n8w-2>li:before{content:"\0025a0 "}.lst-kix_h07r6gi9x3gp-6>li:before{content:"\0025cf "}.lst-kix_a41x0ya2xyd3-0>li:before{content:"\0025cf "}.lst-kix_h07r6gi9x3gp-5>li:before{content:"\0025a0 "}.lst-kix_vkloremw4n8w-3>li:before{content:"\0025cf "}.lst-kix_vkloremw4n8w-4>li:before{content:"\0025cb "}.lst-kix_h07r6gi9x3gp-3>li:before{content:"\0025cf "}ul.lst-kix_h07r6gi9x3gp-8{list-style-type:none}ul.lst-kix_h07r6gi9x3gp-7{list-style-type:none}.lst-kix_vkloremw4n8w-5>li:before{content:"\0025a0 "}.lst-kix_vkloremw4n8w-6>li:before{content:"\0025cf "}.lst-kix_h07r6gi9x3gp-2>li:before{content:"\0025a0 "}.lst-kix_h07r6gi9x3gp-4>li:before{content:"\0025cb "}ul.lst-kix_h07r6gi9x3gp-6{list-style-type:none}.lst-kix_a41x0ya2xyd3-2>li:before{content:"\0025a0 "}ul.lst-kix_h07r6gi9x3gp-5{list-style-type:none}ul.lst-kix_h07r6gi9x3gp-4{list-style-type:none}ul.lst-kix_h07r6gi9x3gp-3{list-style-type:none}ul.lst-kix_h07r6gi9x3gp-2{list-style-type:none}.lst-kix_a41x0ya2xyd3-1>li:before{content:"\0025cb "}ul.lst-kix_h07r6gi9x3gp-1{list-style-type:none}.lst-kix_vkloremw4n8w-7>li:before{content:"\0025cb "}.lst-kix_vkloremw4n8w-8>li:before{content:"\0025a0 "}ul.lst-kix_e7a7d17rpo44-7{list-style-type:none}ul.lst-kix_vkloremw4n8w-4{list-style-type:none}ul.lst-kix_e7a7d17rpo44-6{list-style-type:none}ul.lst-kix_vkloremw4n8w-3{list-style-type:none}ul.lst-kix_vkloremw4n8w-6{list-style-type:none}ul.lst-kix_e7a7d17rpo44-8{list-style-type:none}ul.lst-kix_vkloremw4n8w-5{list-style-type:none}ul.lst-kix_e7a7d17rpo44-3{list-style-type:none}ul.lst-kix_vkloremw4n8w-8{list-style-type:none}ul.lst-kix_e7a7d17rpo44-2{list-style-type:none}ul.lst-kix_vkloremw4n8w-7{list-style-type:none}ul.lst-kix_e7a7d17rpo44-5{list-style-type:none}ul.lst-kix_e7a7d17rpo44-4{list-style-type:none}.lst-kix_h07r6gi9x3gp-8>li:before{content:"\0025a0 "}ul.lst-kix_e7a7d17rpo44-1{list-style-type:none}ul.lst-kix_e7a7d17rpo44-0{list-style-type:none}.lst-kix_e7a7d17rpo44-1>li:before{content:"\0025cb "}ul.lst-kix_vkloremw4n8w-0{list-style-type:none}.lst-kix_kan00gftou8h-0>li:before{content:"\0025cf "}ul.lst-kix_vkloremw4n8w-2{list-style-type:none}.lst-kix_e7a7d17rpo44-2>li:before{content:"\0025a0 "}ul.lst-kix_vkloremw4n8w-1{list-style-type:none}.lst-kix_kan00gftou8h-3>li:before{content:"\0025cf "}.lst-kix_e7a7d17rpo44-3>li:before{content:"\0025cf "}.lst-kix_e7a7d17rpo44-5>li:before{content:"\0025a0 "}.lst-kix_kan00gftou8h-1>li:before{content:"\0025cb "}.lst-kix_kan00gftou8h-2>li:before{content:"\0025a0 "}.lst-kix_e7a7d17rpo44-4>li:before{content:"\0025cb "}.lst-kix_e7a7d17rpo44-7>li:before{content:"\0025cb "}ul.lst-kix_kan00gftou8h-7{list-style-type:none}ul.lst-kix_kan00gftou8h-6{list-style-type:none}ul.lst-kix_kan00gftou8h-8{list-style-type:none}.lst-kix_e7a7d17rpo44-6>li:before{content:"\0025cf "}ul.lst-kix_kan00gftou8h-3{list-style-type:none}ul.lst-kix_kan00gftou8h-2{list-style-type:none}ul.lst-kix_kan00gftou8h-5{list-style-type:none}ul.lst-kix_kan00gftou8h-4{list-style-type:none}ul.lst-kix_kan00gftou8h-1{list-style-type:none}ul.lst-kix_kan00gftou8h-0{list-style-type:none}.lst-kix_e7a7d17rpo44-0>li:before{content:"\0025cf "}.lst-kix_e7a7d17rpo44-8>li:before{content:"\0025a0 "}ul.lst-kix_vvah8cp3zgua-5{list-style-type:none}ul.lst-kix_vvah8cp3zgua-6{list-style-type:none}.lst-kix_h07r6gi9x3gp-0>li:before{content:"\0025cf "}ul.lst-kix_vvah8cp3zgua-3{list-style-type:none}ul.lst-kix_vvah8cp3zgua-4{list-style-type:none}.lst-kix_h07r6gi9x3gp-1>li:before{content:"\0025cb "}ul.lst-kix_vvah8cp3zgua-7{list-style-type:none}ul.lst-kix_vvah8cp3zgua-8{list-style-type:none}ul.lst-kix_40ztqamj21pm-8{list-style-type:none}ul.lst-kix_40ztqamj21pm-7{list-style-type:none}ul.lst-kix_40ztqamj21pm-6{list-style-type:none}ul.lst-kix_40ztqamj21pm-5{list-style-type:none}ul.lst-kix_40ztqamj21pm-4{list-style-type:none}ul.lst-kix_40ztqamj21pm-3{list-style-type:none}ul.lst-kix_40ztqamj21pm-2{list-style-type:none}.lst-kix_vkloremw4n8w-1>li:before{content:"\0025cb "}.lst-kix_vkloremw4n8w-0>li:before{content:"\0025cf "}ul.lst-kix_vvah8cp3zgua-1{list-style-type:none}ul.lst-kix_vvah8cp3zgua-2{list-style-type:none}ul.lst-kix_vvah8cp3zgua-0{list-style-type:none}.lst-kix_vvah8cp3zgua-2>li:before{content:"\0025a0 "}.lst-kix_vvah8cp3zgua-3>li:before{content:"\0025cf "}.lst-kix_40ztqamj21pm-1>li:before{content:"\0025cb "}.lst-kix_vvah8cp3zgua-4>li:before{content:"\0025cb "}.lst-kix_vvah8cp3zgua-6>li:before{content:"\0025cf "}.lst-kix_40ztqamj21pm-2>li:before{content:"\0025a0 "}.lst-kix_vvah8cp3zgua-5>li:before{content:"\0025a0 "}.lst-kix_vvah8cp3zgua-8>li:before{content:"\0025a0 "}ul.lst-kix_a41x0ya2xyd3-8{list-style-type:none}ul.lst-kix_a41x0ya2xyd3-7{list-style-type:none}ul.lst-kix_a41x0ya2xyd3-6{list-style-type:none}.lst-kix_wl1qmy9tv69d-8>li:before{content:"\0025a0 "}ul.lst-kix_a41x0ya2xyd3-5{list-style-type:none}.lst-kix_40ztqamj21pm-0>li:before{content:"\0025cf "}.lst-kix_vvah8cp3zgua-7>li:before{content:"\0025cb "}ul.lst-kix_a41x0ya2xyd3-4{list-style-type:none}.lst-kix_wl1qmy9tv69d-7>li:before{content:"\0025cb "}ul.lst-kix_a41x0ya2xyd3-3{list-style-type:none}ul.lst-kix_a41x0ya2xyd3-2{list-style-type:none}ul.lst-kix_a41x0ya2xyd3-1{list-style-type:none}ul.lst-kix_a41x0ya2xyd3-0{list-style-type:none}.lst-kix_wl1qmy9tv69d-5>li:before{content:"\0025a0 "}.lst-kix_wl1qmy9tv69d-6>li:before{content:"\0025cf "}.lst-kix_wl1qmy9tv69d-3>li:before{content:"\0025cf "}.lst-kix_wl1qmy9tv69d-0>li:before{content:"\0025cf "}.lst-kix_wl1qmy9tv69d-4>li:before{content:"\0025cb "}.lst-kix_40ztqamj21pm-8>li:before{content:"\0025a0 "}.lst-kix_wl1qmy9tv69d-1>li:before{content:"\0025cb "}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}.lst-kix_wl1qmy9tv69d-2>li:before{content:"\0025a0 "}.lst-kix_40ztqamj21pm-3>li:before{content:"\0025cf "}.lst-kix_40ztqamj21pm-5>li:before{content:"\0025a0 "}.lst-kix_40ztqamj21pm-4>li:before{content:"\0025cb "}.lst-kix_40ztqamj21pm-7>li:before{content:"\0025cb "}.lst-kix_40ztqamj21pm-6>li:before{content:"\0025cf "}ol{margin:0;padding:0}table td,table th{padding:0}.c11{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:104.2pt;border-top-color:#000000;border-bottom-style:solid}.c3{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:105.8pt;border-top-color:#000000;border-bottom-style:solid}.c15{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:62.2pt;border-top-color:#000000;border-bottom-style:solid}.c2{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:50.2pt;border-top-color:#000000;border-bottom-style:solid}.c12{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:84.8pt;border-top-color:#000000;border-bottom-style:solid}.c8{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:105pt;border-top-color:#000000;border-bottom-style:solid}.c18{-webkit-text-decoration-skip:none;color:#00796b;font-weight:400;text-decoration:line-through;vertical-align:baseline;text-decoration-skip-ink:none;font-size:11pt;font-family:"Arial";font-style:normal}.c6{margin-left:36pt;padding-top:0pt;padding-left:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c5{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.c20{padding-top:20pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c0{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c1{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:20pt;font-family:"Arial";font-style:normal}.c4{padding-top:0pt;padding-bottom:0pt;line-height:1.0;orphans:2;widows:2;text-align:left}.c9{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c16{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c23{border-spacing:0;border-collapse:collapse;margin-right:auto}.c10{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c22{font-family:Consolas,"Courier New";color:#0d904f;font-weight:400}.c7{padding:0;margin:0}.c13{color:inherit;text-decoration:inherit}.c21{height:11pt}.c14{height:0pt}.c19{margin-left:36pt}.c17{font-style:italic}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}} Posted by Maddie Stone, Project Zero

A guest post describing CVE-2017-7308, a signedness bug in Linux packet sockets leading to a heap out-of-bounds write and local privilege escalation, found via syzkaller.