Ex game cheats dev / Open for employment
Germany
Joined December 2025
- Tweets17
- Following22
- Followers146
- Likes127
Pinned Tweet
Wrote up CVE-2026-50416. win32k maps the desktop heap into every process. Offset 0x100 hands out a raw kernel session pool pointer. Readable from Low IL, AppContainer, even a zero capability LPAC.
github.com/karollooool/CVE-2…
It might sound crazy what I am about to say, but I would not treat this as the end of the story. I’ll leave it at that for now.
In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”.
But was it really fixed?
Ask @tiraniddo
projectzero.google/2026/09/w…
CVE-2026-83991: GENERIC_WRITE and DeleteFileW both return error 5. Same token, CfCreatePlaceholders with SUPERSEDE returns S_OK. Same file ID, new IO_REPARSE_TAG_CLOUD. Microsoft’s affected range goes back to 2018. Writeup:
github.com/karollooool/CVE-2…
karollol retweeted
I have literally two CVEs over the last decade with the same bug, in the same place, again, and again (and ten other researchers have ten more). It’s insane. When I still taught seminars I used to tell my classes “just scan memory for kernel pointers each build”.
Wrote up CVE-2026-50416. win32k maps the desktop heap into every process. Offset 0x100 hands out a raw kernel session pool pointer. Readable from Low IL, AppContainer, even a zero capability LPAC.
github.com/karollooool/CVE-2…
karollol retweeted
CVE-2026-50416: Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally
Windows 11 KASLR bypass PoC
github.com/karollooool/CVE-2…
