Hello, this is t0be! I’m back with the "Lone Wolves" series, previously featured by gongjae. However, the topic is quite different this time. Today, I’m presenting an analysis of Android Auto dongles. What exactly is an Android Auto dongle, and how does it work? More importantly, is it a secure device? Check out the blog for all the details! hackyboiz.github.io/2026/10/…

[1day1line] CVE-2026-42980: Privilege Escalation via an Integer Underflow in Windows WMI Hello, This is minzu. Today's 1day1line covers a local privilege escalation vulnerability in the Windows kernel's WMI code (ntoskrnl.exe). When multiple WMI query results are written into one buffer, subtracting an 8-byte-aligned result size without checking the remaining output space can cause an integer underflow. The resulting size miscalculation can lead to a nonpaged pool buffer overflow. The public PoC demonstrates escalation to SYSTEM on vulnerable systems. Please refer to the blog post for more details! hackyboiz.github.io/2026/10/…

[1day1line] CVE-2024-30088: Privilege Escalation via a TOCTOU Race Condition in Windows Kernel Token Security Attribute Copyout Hello, this is SeoPPak. Today’s 1day1line covers a TOCTOU race condition in the Windows kernel’s handling of NtQueryInformationToken with TokenAccessInformation. The destination UNICODE_STRING descriptor for a security attribute name was placed in a user-mode buffer, allowing a write-then-read-back double fetch. By using this to perform a constrained write aligned with the token’s privilege fields, we reproduced privilege escalation to SYSTEM. Please refer to the blog post for more details! hackyboiz.github.io/2026/10/…

[1day1line] CVE-2026-58222: LDAP Compare ACL Bypass in Samba AD Hello, this is millet. Today's 1day1line covers an Information Disclosure vulnerability in Samba Active Directory Domain Controller caused by LDAP Injection and improper access control during LDAP Compare operations. This vulnerability allows a low-privileged domain user to recover confidential attributes, including msKds-RootKeyData, through repeated LDAP Compare requests. The recovered KDS Root Key can then be used to derive gMSA passwords, potentially leading to domain compromise. Please refer to the blog post for more details! hackyboiz.github.io/2026/10/…

[1day1line] CVE-2026-49177: System EoP via Logical Bug in Android InCallController Hello, this is newp1ayer48. Today's 1day1line is System EoP vulnerability caused by a logical bug in the Android InCallController. This vulnerability allows code from a standard app to execute within the `system_server` process—triggered while checking for the existence of a service class—ultimately leading to System-level (uid=1000) EoP. Please refer to the blog post for more details! hackyboiz.github.io/2026/10/…

Hello, Libera is back, this time with [Two paths, Same Dream] 💭! A Windows-only guy going headfirst into Android Part 0 maps out the core of IPC mechanisms before you hunt a single bug. We break down the 'Parcel Mismatch' vulnerability, explore Android 13's Lazy Bundle mitigation, and analyze how the recent CVE-2025-48535 1-Day bypassed it to hijack system privileges. Full details on the blog, Let's dive in! 👇 hackyboiz.github.io/2026/10/… #Android #IPC #ParcelMismatch #CVE_2025_48535 #Hackyboiz

Hello, gongjae is back, this time with [Lone Wolves]! A Windows-only guy going headfirst into macOS Part 0 maps out where to even look in this OS before you hunt a single bug. Full details on the blog, here we go~!! hackyboiz.github.io/2026/10/… #hackyboiz #gongjae #macOS

[1day1line] CVE-2026-107181: 1-Click ATO via IPC Injection in Telegram Desktop Hello, this is ji9umi. Today's 1day1line explores a 1-Click Account Takeover (ATO) vulnerability in Telegram Desktop caused by IPC Injection. The vulnerability originates from improper data delimiter handling in the Windows version of Telegram Desktop, allowing an attacker to reach an internal-only URI scheme. This behavior serves as the entry point for an exploit chain that can ultimately read local files and steal account credentials, leading to account takeover. For a detailed technical breakdown, check out the blog post below! hackyboiz.github.io/2026/10/…

[1day1line] CVE-2026-49177: Out-of-Bounds Read Vulnerability in the Windows TCP/IP Driver hackyboiz.github.io/2026/10/… The vulnerability occurred because the user-controlled variable MaxDestCount was used to determine the number of iterations in a loop without being validated.

[1day1line] CVE-2026-64560: Use-after-free in Linux Kernel POSIX CPU timers caused by a race with non-leader execve() Today's 1day1line covers a use-after-free vulnerability in the Linux Kernel POSIX CPU timer implementation. When a non-leader thread calls execve(), the thread-group leader can change while another CPU is deleting a process CPU timer. This race can leave a timerqueue node referencing a freed k_itimer, resulting in a UAF. Please refer to the blog post for details! hackyboiz.github.io/2026/10/…

[1day1line] CVE-2026-50343: LPE in Windows InstallService caused by Improper Privilege Management Hello, this is banda. Today's 1day1line covers a privilege escalation vulnerability in Windows InstallService. A standard user can specify a COM class through StaticPluginMap and use a writable CrossDevice DLL path to load an attacker-controlled DLL with SYSTEM privileges. This vulnerability is known as Dark Elevator. Please refer to the blog post for details! hackyboiz.github.io/2026/09/…

[1day1line] CVE-2025-43529: Use-after-free in JavaScriptCore caused by missing escape propagation to Phi nodes in the DFG StoreBarrierInsertionPhase Hello, this is gongjae. Today's 1day1line covers a use-after-free vulnerability in WebKit's JavaScriptCore. The DFG JIT recognized that a Phi node had escaped, but it did not apply escape handling to the values flowing into that Phi through Upsilon nodes, so the required StoreBarrier was never inserted. As a result, the concurrent GC misses an object it should have scanned, and a live object ends up being freed. Please refer to the blog post for details! hackyboiz.github.io/2026/09/…

[1day-1line] CVE-2026-28666: Exposure of Untrusted RAW Decoders in SystemUI via a mimetype Check Bypass in Android LocalImageResolver Hello, this is Libera. Today's 1day-1line covers a check bypass in Android's notification image path. Google added a mimetype allowlist to LocalImageResolver to keep the bug-prone RAW decoders out of the notification path, but the check was wired into only 1 of its 7 call sites. As a result, an attacker app can run the blocked DNG decoder inside the SystemUI process with a single setLargeIcon() call. Depending on the decoded content, this can lead to a Persistent DoS or EOP. Please refer to the blog post for more details (Root Cause, PoC, and Patch info)! hackyboiz.github.io/2026/09/…

[Wipeload Project ⛰️ — Step 9] Beyond the Chain (END.) Hi, this is the Wipeload team. Our Wipeload project has finally come to an end. To wrap things up, we’re sharing some final thoughts after this long journey. Thank you to everyone who walked this path with us along the way! We’ll keep working to bring you more interesting research in the future. :) Wipeload Project END. → hackyboiz.github.io/2026/08/…

[Wipeload Project ⛰️ — Step 8] Chrome Full-Chain Exploitation Time to complete the Full Chain 🔗 In this final step, we take the Medium Integrity code execution from our Chrome Sandbox Escape, chain it with CVE-2023-29360, and abuse MDL handling in mskssrv.sys to reach SYSTEM — completing the journey from Chrome Renderer to SYSTEM! Let’s finish the chain! hackyboiz.github.io/2026/08/… #Hackyboiz #Wipeload #ChromeFullChain #BrowserExploitation #SandboxEscape #WindowsLPE #CyberSecurity

[Wipeload Project ⛰️ — Step 7] Chrome Full-Chain Exploitation Hello this is Hackyboiz 🐣 With Renderer RCE secured, we turn to Windows kernel memory management. This article explores how mishandled MDLs lead to kernel vulnerabilities—from Lifetime Bugs and Double Free to MDL Mismatch and Forgotten Lock cases. Let’s trace how these MDL bugs unfold in the kernel! hackyboiz.github.io/2026/08/… #Hackyboiz #Wipeload #ChromeFullChain #BrowserExploitation #SandboxEscape #WindowsLPE #CyberSecurity