Clément Labro

@CravateRouge Merci ! Si, c'est assez fastidieux en effet, mais c'est le genre de chose que je dois faire régulièrement pour PrivescCheck de toute façon. Et puis j'ai ajouté les définitions uniquement pour les types dont j'avais besoin. 😉

🆕 New blog post!

"BitLocker's Little Secrets: The Undocumented FVE API"

A small Windows RE adventure to figure out how to get the status and configuration of a BitLocker protected drive programmatically and without admin privileges.

Now also implemented in PrivescCheck! 🔥

👉 https://itm4n.github.io/bitlocker-little-secrets-the-undocumented-fve-api/

Yet another abuse of the missing "CrossDevice.Streaming.Source.dll" DLL!

After CVE-2025-24076 / CVE-2025-24076 found by Compass Security, Researcher Oscar Zanotti Campo found another vulnerability that he could exploit using the built-in misconfigured COM class referencing this DLL. This is CVE-2026-21508. 🔥

👉 https://0xc4r.github.io/posts/CVE-2026-21508/
👉 https://github.com/0xc4r/CVE-2026-21508_POC/
👉 https://blog.0patch.com/2026/03/micropatches-released-for-windows.html

#Windows #cve #cve_2026_21508 #vulnerability

@tiraniddo@infosec.exchange Yes, it does, but the handle returned to the client only has the SYNCHRONIZE right. :/ The client has full control of the command line arguments. I thought about the COM IRundown trick indeed, but I wondered if there was something more straightforward. ^^ I don't see any reason it would not work though. One thing to note is that the process inherits the client's environment variables.

This is my analysis (and PoC) for CVE-2026-20817, a privilege escalation in the Windows Error Reporting service.

👉 https://itm4n.github.io/cve-2026-20817-wersvc-eop/

Credit goes to Denis Faiustov and Ruslan Sayfiev for the discovery.

TL;DR A low privilege user could send an ALPC message to the WER service and coerce it to start a WerFault.exe process as SYSTEM with user-controlled arguments and options. I did not achieve arbitrary code execution, but perhaps someone knows how this can be done? 🤷‍♂️

@CravateRouge Yes, I know, me neither. As I wrote an the end of the blog post, I didn't go any further than that.

@CravateRouge Hey! Merci. :) Yes, there are many interesting vulnerabilities like this that get patched each month. It's too bad they are generally not documented publicly. I have another one in store from the January 2026 Patch Tuesday. Hopefully, I'll be able to figure it out and publish a writeup as well. 🤞

It's a blog post I should have published months ago, but here we finally are.

"CVE-2025-59201 - Network Connection Status Indicator (NCSI) EoP"

Credit goes to t0zhang (on X) for the discovery.

👉 https://itm4n.github.io/cve-2025-59201-ncsi-eop/

I'd like to write more of those but it's so time-consuming. 😔

#cve #windows

One of the best blog posts I've read recently. Complex subject but very accessible explanations. Great job by Ksawery Czapczyński a.k.a. @0xXaFF.

"PatchGuard Peekaboo: Hiding Processes on Systems with PatchGuard in 2026"

https://www.outflank.nl/blog/2026/01/07/patchguard-peekaboo-hiding-processes-on-systems-with-patchguard-in-2026/

A nice and short blog post about blinding EDR with WFP by my colleague Florian.

"Blinding EDRs: A deep dive into WFP manipulation"

https://blog.scrt.ch/2025/08/25/blinding-edrs-a-deep-dive-into-wfp-manipulation/