CVE-2026-21509

GitHubCurated repository PoCScannerC++SecureWithUmer/CVE-2026-PoCs

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

PowerShell script that checks for and applies a COM Kill-Bit registry mitigation for CVE-2026-21509. It does not exploit the vulnerability; it only detects exposure and applies a workaround.

Backdoor review

No backdoor observed in reviewed code

The artifact is a PowerShell script and README that manage a COM Kill-Bit for CVE-2026-21509. The script reads and writes specific registry keys, creates a harmless RTF test file, and queries installed hotfixes. No backdoor, concealed executable payload, credential theft, persistence, or unrelated remote access behavior is present. The script's operations are limited to the documented mitigation actions.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPowerShell
Target softwareMicrosoft Office 2016Microsoft Office 2019Microsoft Office LTSC 2021Microsoft Office LTSC 2024Microsoft 365 Apps
Attack typessecurity feature bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only reads registry state, writes a mitigation value, and checks for patches. It does not contain any code that triggers or exercises the vulnerability (e.g., loading a malicious COM object to achieve code execution). The README explicitly states the test file is safe and contains no executable code.

suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:1-390suuhm-CVE-2026-21509-handler-f004e70/README.md:111

Requirements

  • Administrator rights required to modify registrysuuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:3
  • Windows 10/11 with Office 2016+ installedsuuhm-CVE-2026-21509-handler-f004e70/README.md:24

Observed behavior

  • Checks registry for presence of Kill-Bit (Compatibility Flags = 0x400) for CLSID {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:43-65
  • Applies Kill-Bit by creating registry key and setting Compatibility Flags DWORD to 0x400suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:81-114
  • Creates a benign RTF test file containing the CLSID to verify Kill-Bit blocks COM object activationsuuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:116-131
  • Checks for installed KB5002694 and KB5002695 patches via Get-HotFixsuuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:157-179
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Registry Modification
Sets 'Compatibility Flags' DWORD to 0x400 under HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} and WOW6432Node equivalentsThis is the documented Kill-Bit mitigation for the CVE; it disables the vulnerable COM object.suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:99
File Creation
Creates %TEMP%\CVE202621509_KillBit_Test.rtf containing a static RTF string with the CLSIDThe file is a non-executable test artifact to verify the Kill-Bit blocks the COM object; it contains no active content.suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:119-121
System Information Disclosure
Queries installed hotfixes via Get-HotFix and displays KB5002694/KB5002695 statusThis is a local diagnostic check for the official patches; no data is exfiltrated.suuhm-CVE-2026-21509-handler-f004e70/CVE-2026-21509.ps1:163
Review boundaries

What the analysis did not establish

  • Evidence consists of two text files; one unclassified file (likely binary) is present but not analyzed, though it is not required for classification of the primary artifact.
  • One unclassified file (11357 bytes) is present in the artifact inventory but was not inspected; its content is unknown.
  • The review is based solely on the supplied text files; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1