Reported by 1 outlet

Timeline

1. original reporting

   CVE-2026-40369 — Windows Kernel LPE: 100% Reliable SYSTEM from Any Sandbox — Ori Nimron Drops Full Exploit After Pwn2Own Rejection

   cyberpress.org · 140d ago · May 27th, 2026

   A critical vulnerability in the Windows kernel (ExpGetProcessInformation via NtQuerySystemInformation info class 253) allows any unprivileged process — including a sandboxed Chrome, Edge, or Firefox renderer — to escalate deterministically to NT AUTHORITY\SYSTEM. Researcher Ori Nimron built a working exploit intended for Pwn2Own Berlin 2026 but was turned away due to venue capacity; he publicly dropped the full exploit chain, including a Chrome sandbox emulator PoC on GitHub.

   The bug has two compounding failures that bypass kernel protections: when Length=0 is passed to the syscall, ProbeForWrite becomes a complete no-op (its entire body is conditioned on if (Length)), so any pointer including raw kernel-mode addresses passes through. Simultaneously, class 253 dispatches via a goto statement that intentionally skips the pointer sanitization step used correctly by neighboring classes 5 and 252. The result is a direct, arbitrary increment of kernel memory at attacker-supplied addresses — incrementing three DWORDs (process count, thread count, handle count) per running process.

   Critically, Windows lacks SMAP (Supervisor Mode Access Prevention), relying entirely on __try/__except software guards — meaning corrupted kernel pointers freely dereference attacker-controlled user-mode pages without crashing. The published five-stage exploit chains a prefetch side-channel for ntoskrnl base leak, class 253 primitive for registry array corruption, arbitrary kernel read via fake UNICODE_STRING, privilege enablement via token+0x42 byte increment, and CreateRemoteThread into winlogon.exe for SYSTEM shell.

   Microsoft patched CVE-2026-40369 (CVSS 7.8) in the May 2026 Patch Tuesday — this update is urgent for any Windows 11 24H2/25H2 or Windows Server 2025 deployment.

   ---