CVE-2021-31728

CVE-2021-31728 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including irql.

AI-analyzed exploit summary This repository contains functional exploit code for CVE-2021-31728, demonstrating arbitrary ring 0 code execution via IOCTL abuse in MalwareFox AntiMalware's zam64.sys/zam32.sys driver. The PoC includes detailed technical analysis and working C code for both disk read/write and kernel execution exploits.

Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook with IOCTL 0x80002044 and execute the executable memory using this hook with IOCTL 0x80002014 or 0x80002018, this exposes ring 0 code execution in the context of the driver allowing the non-privileged process to elevate privileges.