CVE-2026-24289

GitHubCurated repository PoCScannerCexploitintel/eip-pocs-and-cves

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a scanner that triggers a race condition to detect a use-after-free vulnerability (CVE-2026-24289) in the Windows Kernel IO Completion Port subsystem. It creates a named pipe, associates it with IO Completion Ports, and races IRP completions against IOCP reassociations. The code reports whether a crash (BSOD) occurs, indicating an unpatched system, or completes without a crash, indicating a patched system. It does not perform heap grooming, arbitrary memory corruption, or privilege escalation.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README, a build script, and a C source file that trigger a documented Windows kernel race condition. The code performs only the described IOCP race operations (pipe I/O, IOCP reassociation) and contains no concealed executable behavior, persistence, credential theft, or unrelated payloads.

ClassificationScanner
Model confidence95%
AuthenticationRequired
Languagescbatchfile
Target softwareWindows NT Kernel (ntoskrnl.exe)
Attack typesuse-after-freerace-condition
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code's primary operation is to trigger a race condition and observe whether a crash occurs, which is a detection mechanism, not an exploitation primitive. The README explicitly states the PoC 'triggers the TOCTOU race condition' and expects a BSOD on unpatched builds, confirming it is a scanner. The code does not contain heap grooming, arbitrary write, or privilege escalation logic.

README.md:75-78poc/exploit.c:1-38

Requirements

  • Local authenticated user with low privilegesREADME.md:25
  • Unpatched Windows build prior to KB5079473README.md:17

Observed behavior

  • Creates two IO Completion Ports and a named pipe pair with overlapped I/Opoc/exploit.c:122-160
  • Launches an IO thread that issues overlapped NtReadFile and completes it via NtWriteFile to trigger IRP completionpoc/exploit.c:179-226
  • Launches race threads that rapidly reassociate the pipe's file handle with different IOCPs and NULL using NtSetInformationFilepoc/exploit.c:230-271
  • Monitors for system crash (BSOD) to determine if the vulnerability is present; reports completion without crash on patched systemspoc/exploit.c:351-355
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Behavior
Race condition trigger via NtSetInformationFile(FileCompletionInformation) and overlapped pipe I/OThe exploit.c code creates a named pipe pair, associates it with IOCPs, and races IOCP reassociation against IRP completion to trigger a use-after-free in ntoskrnl.exe. This matches the documented CVE-2026-24289 vulnerability.poc/exploit.c:190-223poc/exploit.c:240-268
Network
No network activityThe code uses only local named pipes and kernel objects; no socket, HTTP, or other network APIs are called.poc/exploit.c:1-365
Persistence
No persistence mechanismNo registry writes, scheduled tasks, service creation, or startup folder modifications are present.poc/exploit.c:1-365
Review boundaries

What the analysis did not establish

  • Evidence does not include execution results on an unpatched system; only a patched system test is described.
  • The artifact is a single PoC unit; no additional context or external dependencies are provided.
  • Only the three text files (README.md, build.bat, exploit.c) were reviewed; no binary artifacts were present or analyzed.
  • The review does not assess whether the PoC successfully triggers the vulnerability on unpatched systems.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1