Posts

2026

• Nov 12, 2026 · 80 min read

  CVE-2026-112766: How a Standard User Races a Rename into a Kernel Pool Overflow in Windows FastFAT and exFAT

  A double fetch in the FastFAT and exFAT EFS post-create path lets a standard user race a rename into a kernel pool overflow. Fixed in 10.0.26100.9974.

• Nov 10, 2026 · 33 min read

  CVE-2026-89020: How a Read-Only MikroTik RouterOS Account Writes Past a Stack Buffer in /tool fetch

  Any RouterOS account, the read-only group included, can make /tool fetch copy a tftp:// path of any length into a 528-byte stack buffer.

• Oct 21, 2026 · 33 min read

  CVE-2026-73014 (PLUSONE): Reading Another User’s Files Through the Windows Data Sharing Service

  A standard user gets the contents of a file its own permissions deny, because another user who also could not read it added them to a sharing token.

• Aug 16, 2026 · 34 min read

  CVE-2026-5917: OS Command Injection in libgit2’s SSH Backend

  libgit2’s libssh2 backend quotes the repository path but escapes nothing. One quote in the path can run commands on an SSH server that gives a shell.

• Jul 21, 2026 · 20 min read

  Claude Cowork Boots Its Sandbox From a Folder You Can Rewrite

  Cowork boots a Hyper-V VM from user-writable AppData with no hash or signature check. Replace the initrd; SYSTEM boots it.