https://exploit-intel.com/blog/tags/race-condition/EIP research articles tagged race-condition.en-usSun, 17 May 2026 10:31:46 -0400https://exploit-intel.com/blog/posts/cve-2026-41702-vmware-fusion-cnxtmp-symlink-race/https://exploit-intel.com/blog/posts/cve-2026-41702-vmware-fusion-cnxtmp-symlink-race/A TOCTOU race in VMware Fusion 25's vmx-apple binary that turns booting a VM into arbitrary chown, then arbitrary chown into a passwordless root shell via PAM injection. World-writable sticky directory, SUID-root callee, bind() and chown() both following symlinks, a 5-15 microsecond window between them. Full LPE chain in 40 seconds, single VM boot. The interesting part is what made it reliable.Sun, 17 May 2026 10:31:46 -0400https://exploit-intel.com/blog/posts/cve-2026-24289-winforge-kernel-iocp-race-condition/https://exploit-intel.com/blog/posts/cve-2026-24289-winforge-kernel-iocp-race-condition/WinForge's maiden voyage: a brand new pipeline module - QEMU VMs instead of Docker, WinDbg instead of GDB, binary diffing instead of source - pointed at a use-after-free in ntoskrnl.exe. 363 functions changed between builds, 8 needles in the haystack, and a PoC that ran 500,000 iterations without crashing. Because that was the point.Mon, 16 Mar 2026 18:00:00 -0400