CVE-2026-40369Exploit(microsoft / windows_11_24h2)

CVE-2026-40369 A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandbox May has been too generous with all that.. Be careful and patch https://github.com/orinimron123/CVE-2026-40369-EXPLOIT #cybersecurity

CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox https://voidsec.com/cve-2026-40369-browser-sandbox-escape/ #infosec https://t.co/nL5nTzNZqk

I originally prepared this bug for Pwn2Own Berlin. A few days before the contest, a CVE got assigned. So, here is my technical analysis and exploitation strategy for CVE-2026-40369: a 12-byte kernel increment, exploitable both as an LPE and SBX. https://voidsec.com/cve-2026-40369-browser-sandbox-escape/

‼️ CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox. CVSS: 7.8 Writeup: https://voidsec.com/cve-2026-40369-browser-sandbox-escape/ PoC: https://github.com/orinimron123/CVE-2026-40369-EXPLOIT Credit: http://youtube.com/@VoidSec https://t.co/N6EwopDbR1

GitHub - orinimron123/CVE-2026-40369-EXPLOIT: Full exploit code for CVE-2026-40369 - A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandbox · GitHub https://github.com/orinimron123/CVE-2026-40369-EXPLOIT

As promised - full blog post is live for CVE-2026-40369 Covers everything: initial research, methodology, the exploitation path, caveats, cleanups, etc. The whole journey from finding it to production-grade exploit: https://pwn2nimron.com/blog

CVE-2026-40369: Arbitrary Kernel Address Increment via NtQuerySystemInformation TL;dR: One syscall from any unprivileged process, even inside Chrome’s renderer sandbox, can increment arbitrary kernel memory addresses, giving SYSTEM privilege escalation https://pwn2nimron.com/blog https://t.co/WRck0kifCO

cl /W4 /O2 poc.c /Fe:poc.exe /link ntdll.lib That single command builds a working exploit for CVE-2026-40369. The flaw sits in ntoskrnl.exe inside ExpGetProcessInformation. Info class 253 accepts a caller-supplied kernel address when the length argument is zero. Because the ProbeForWrite guard is wrapped inside an `if (Length)` check, a zero-length call skips validation entirely. The function then walks every process and executes three increments at the attacker-chosen address: `++*v95; v95[1] += threadCnt; v95[2] += handleCnt`. The primitive is deterministic and reachable from any sandbox that can still issue NtQuerySystemInformation, including Chrome, Edge, and Firefox renderers. It affects Windows 11 24H2 and 25H2. A crash lands as bugcheck 50 at nt!ExpGetProcessInformation+0x42e. Ori Nimron published the PoC at http://github.com/orinimron123/CVE-2026-40369-EXPLOIT. Combined with any KASLR leak the increment turns into a direct LPE. A length guard that only protects non-zero buffers leaves the kernel address exposed on every call.

Full exploit code for CVE-2026-40369 - A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandbox https://github.com/orinimron123/CVE-2026-40369-EXPLOIT

Windows 11最新環境で動作するカーネル権限昇格ゼロデイ「CVE-2026-40369」が公開された。NtQuerySystemInformationの欠陥を悪用し、Chromeサンドボックス内の低権限プロセスからでもカーネルメモリ書き換えが可能になる。 問題はntoskrnl.exe内のExpGetProcessInformationに存在し、SystemProcessInformationExtension（クラス253）処理時のNULLチェック欠如が原因だ。Length=0で呼び出すとProbeForWriteが完全に回避され、攻撃者が指定したカーネルアドレスへDWORD加算処理が実行される。これにより任意カーネルメモリのインクリメントが可能になり、権限昇格プリミティブとして悪用できる。 PoCではNtQuerySystemInformationへ細工したカーネルアドレスを渡し、プロセス数やスレッド数に応じた加算処理を実行する様子が示された。未マップ領域を指定した場合はBSODを引き起こすが、適切なアドレスを選べば安定動作するとされ、研究者は「100％決定論的」と主張している。 影響はWindows 11 24H2〜25H2で確認され、Chrome、Edge、Firefoxのサンドボックスからも到達可能とされる。KASLR回避には別ツールとの連携も提案されているが、現時点でMicrosoftから修正情報は出ていない。 https://github.com/orinimron123/CVE-2026-40369-EXPLOIT

Windows unprivileged arbitrary 12-byte kernel write to escape the browser sandbox https://voidsec.com/cve-2026-40369-browser-sandbox-escape/ #infosec

Escaping the Browser Sandbox via the Windows Kernel Vulnerability CVE-2026-40369 PT ID: PT-2026-40204 The article examines the vulnerability CVE-2026-40369 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-40369), which enables a browser sandbox escape due to an error in handling a system call. The author shows how even a limited ability to write to kernel memory can be turned into a full exploitation primitive. The material подробно demonstrates the exploitation process, including gaining SYSTEM privileges and bypassing security mechanisms. Ultimately, the vulnerability allows an attacker to move from code execution inside the browser to full control over the operating system. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-40204 📎 Article: https://voidsec.com/cve-2026-40369-browser-sandbox-escape/ #dbugs_attacks

@M4x_1997 4/4: Last but not least CVE-2026-40369 - Windows Kernel Arbitrary Increment primitive reachable from any browser sandbox renderer process This one was rejected from Pwn2Own and closed anyway yesterday :( My exploit is here - blogpost will be soon: https://github.com/orinimron123/CVE-2026-40369-EXPLOIT https://t.co/nG8vwixZO2

Technical analysis and exploitation strategy for CVE-2026-40369: a 12-byte kernel increment exploitable both as LPE and SBX. Originally prepared for Pwn2Own Berlin, the bug became public shortly before the contest after CVE assignment. https://voidsec.com/cve-2026-40369-browser-sandbox-escape/

[1day-1line] CVE-2026-40369: Arbitrary Kernel Address Increment LPE/Sandbox Escape Vulnerability Caused by Untrusted Pointer Dereference in Windows Kernel(ntoskrnl.exe) Hello, this is banda. Today's 1day-1line covers an LPE/Sandbox Escape vulnerability in the Windows Kernel. In the NtQuerySystemInformation Class 253 path, Length=0 can bypass pointer validation and trigger a limited 12-byte kernel write primitive at an attacker-controlled kernel address, potentially leading to SYSTEM privilege escalation even from restricted environments such as a browser renderer sandbox. Please refer to the blog post for more details! https://hackyboiz.github.io/2026/06/17/banda/CVE-2026-40369/

CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox https://core-jmp.org/2026/06/cve-2026-40369-twelve-bytes-browser-sandbox-escape/

🚨 Windows 11 Local Privilege Escalation Exploit Advertised on Underground Forum A threat actor is advertising a ready-to-use Local Privilege Escalation (LPE) exploit allegedly targeting Windows 11 24H2 and 25H2 systems. * The seller claims the exploit weaponizes CVE-2026-40369 and is being offered for $10,000. * According to the advertisement, the exploit allegedly: * Supports multiple Windows builds without modification * Achieves SYSTEM-level privileges * Avoids common process injection techniques * Claims low detection rates by endpoint security products * Works more reliably on Intel processors than AMD systems * Has limited effectiveness in virtualized environments * The actor further claims the exploit requires access to ntoskrnl.exe memory layout information and relies on kernel-level behavior to achieve privilege escalation. * No proof-of-concept, demonstration video, or independent validation was publicly provided in the listing. * At the time of reporting, Daily Dark Web could not independently verify the authenticity, reliability, or exclusivity of the advertised exploit. Analyst Note: Functional Windows LPE exploits remain highly valuable in cybercriminal and nation-state operations because they are frequently chained with phishing, malware, browser exploits, or initial access brokers to obtain SYSTEM privileges and disable security controls. Organizations should prioritize June Patch Tuesday updates, monitor for abnormal privilege escalation activity, and treat public exploit-sale claims with caution until technical validation becomes available. #DDW #Intelligence #DarkWeb #Windows

Full exploit code for CVE-2026-40369 - A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandbox https://github.com/orinimron123/CVE-2026-40369-EXPLOIT

#Kernel_Security CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox https://voidsec.com/cve-2026-40369-browser-sandbox-escape ]-> Full Exploit PoC - https://github.com/orinimron123/CVE-2026-40369-EXPLOIT // Windows kernel vulnerability enabling unprivileged arbitrary kernel memory writes via 'NtQuerySystemInformation', allowing privilege escalation to SYSTEM by forging tokens, affecting Windows 11 25H2 and Windows Server 2025

CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox https://voidsec.com/cve-2026-40369-browser-sandbox-escape/