Post #4043382
2026-07-23 18:32 UTC
Today's accomplishment:
Code execution as NT AUTHORITY\SYSTEM, triggered by playing a music file on Windows.
Local environment configuration by a non-admin user required, so this definitely isn't RCE. Just LPE.
If MSRC requires me to provide a video of the exploit, that'll force my hand to drop 0day. 😂
Replies (4)
-
@cR0w@infosec.exchange 2026-07-23 18:36
@wdormann@infosec.exchange So are you taking requests for the music to play in the video demo?
-
@wdormann@infosec.exchange 2026-07-24 00:26
Fun fact: If you go to report a vulnerability to MSRC that is a missed-fix or a variant of something that Microsoft has already released an update for, you must provide the existing VULN- identifier. Meaning, only the person who reports a vulnerability to Microsoft is allowed to tell them that the fix wasn't good enough. (The VULN- ID is what you get when you submit a case to MSRC) Great job, folks.
-
@winload_exe@wetdry.world 2026-07-23 19:18
@wdormann@infosec.exchange hi-fi rushed fix
-
@fellows@cyberplace.social 2026-07-23 21:14
@wdormann@infosec.exchange new submission requirement is screenshots of the vuln recreated on an original Etch a Sketch.