Y5neKO

Classification basis

The primary artifact is classified as an exploit because it contains functional code (exploit_cve_2026_8461.py) designed to generate a malicious input that exercises a vulnerability to achieve arbitrary code execution, not merely detect it. The script's docstring and README explicitly state it is a 'Full RCE Exploit Generator' that implements a chain from OOB Write to system() call.

Requirements

• ASLR must be globally disabled (kernel.randomize_va_space=0) for the exploit's hardcoded addresses to be valid.README.md:47exploit_cve_2026_8461.py:19
• A calibration step must be performed on the target machine to determine the exact heap layout, including the address of system() and the offset of the AVBuffer struct.README.md:62-81exploit_cve_2026_8461.py:25-28
• The target must be running a vulnerable version of FFmpeg (≤ 8.0.1) on x86_64 with glibc malloc.CVE-2026-8461_Analysis.md:15-18exploit_cve_2026_8461.py:20

Observed behavior

• The exploit_cve_2026_8461.py script generates a malicious AVI file. When this file is decoded by a vulnerable FFmpeg, it triggers a 640-byte heap out-of-bounds write.exploit_cve_2026_8461.py:1-6CVE-2026-8461_Analysis.md:3
• The out-of-bounds write is used to overwrite the 'free' function pointer in an adjacent AVBuffer struct with the address of system(), and the 'opaque' field with a pointer to a shell command string also placed on the heap.exploit_cve_2026_8461.py:192-238CVE-2026-8461_Analysis.md:179-210
• When the decoded frame is freed, the hijacked function pointer is called, resulting in the execution of the attacker-supplied shell command (e.g., 'id > /tmp/pwned').CVE-2026-8461_Analysis.md:505-512README.md:108-113

Observables

Exploit Chain

Payload withheldThe exploit generator (exploit_cve_2026_8461.py) builds a crafted AVI file that triggers a heap out-of-bounds write in FFmpeg's MagicYUV decoder, overwrites the AVBuffer.free function pointer with system(), and places a shell command on the heap. When the frame is freed, system(cmd) is called.exploit_cve_2026_8461.py:192-238CVE-2026-8461_Analysis.md:132-210

Command Execution

Payload withheldThe exploit is designed to execute an arbitrary shell command via system(). The README and analysis documents show the expected result: the command executes, then the process crashes due to heap corruption.README.md:88-113CVE-2026-8461_Analysis.md:485-512

Calibration Requirement

Payload withheldThe exploit requires a calibration step to determine the exact heap addresses of system() and the command string, as well as glibc chunk metadata that must be preserved. This is documented as a prerequisite for the exploit to work.README.md:42-48CVE-2026-8461_Analysis.md:277-282

Classification basis

The code actively exploits CVE-2026-31431 to achieve privilege escalation. It does not merely detect the vulnerability; it performs a series of operations (socket creation, splice, page cache corruption) to replace a binary with attacker-controlled code and then executes it to gain a root shell. The README explicitly labels the files as 'exploit' and provides compilation and execution instructions.

Requirements

• Local unprivileged user access to a vulnerable Linux kernel (versions 4.14 through 6.19.12, and 7.0-rc*) with the AF_ALG AEAD module available.README.md:1
• Target binary payload withheld must exist and be readable.exploit.c:163exploit-python3-8-10.py:122

Observed behavior

• Opens payload withheld for reading.exploit.c:163exploit-python3-8-10.py:122
• Creates an AF_ALG AEAD socket bound to 'authencesn(hmac(sha256),cbc(aes))' and configures it with a crafted key, authsize=0, and DECRYPT operation.exploit.c:84-101exploit-python3-8-10.py:77-85
• Sends a crafted message with AEAD control messages (ALG_SET_OP, ALG_SET_IV, ALG_SET_AEAD_ASSOCLEN) to the operation socket.exploit.c:107-141exploit-python3-8-10.py:92-102
• Uses splice(2) to move data from the su file descriptor into the operation socket via a pipe, triggering the use-after-free to corrupt the page cache.exploit.c:143-150exploit-python3-8-10.py:104-109
• Repeats the process in 4-byte chunks to overwrite the entire page cache of payload withheld with a minimal ELF payload that calls setuid(0) and execve('/bin/sh').exploit.c:166-167exploit-python3-8-10.py:128-131
• Executes payload withheld, which now runs the injected payload, resulting in a root shell.exploit.c:172-173exploit-python3-8-10.py:135-136

Observables

Target File

Payload withheldThe exploit targets payload withheld for page cache poisoning and replacement with a setuid(0)+execve(/bin/sh) payload.exploit.c:4-5exploit-python3-8-10.py:5-6

Payload

Payload withheldThe payload embedded in both exploits is a small ELF binary that sets the user ID to root and executes /bin/sh, consistent with a local privilege escalation proof-of-concept.exploit.c:39-51exploit-python3-8-10.py:62-69

Exploit Technique

Payload withheldBoth exploits use the same technique: creating an AF_ALG AEAD socket, setting up decryption with specific parameters, and using splice to trigger a use-after-free that corrupts the page cache of the target file.exploit.c:65-157exploit-python3-8-10.py:74-118