CVE-2026-33825

This repository contains a functional exploit PoC for CVE-2026-33825, targeting a Windows kernel vulnerability related to Volume Shadow Copy Service (VSS) manipulation. The code interacts with the Windows object manager and NTDLL functions to enumerate and manipulate shadow copy volumes, indicating a local privilege escalation (LPE) vector.

This repository provides a detailed technical analysis of CVE-2026-33825, a TOCTOU race condition vulnerability in Microsoft Defender that allows local privilege escalation to SYSTEM via NTFS reparse points and opportunistic locks.

The repository contains a functional exploit PoC for CVE-2026-33825, targeting Windows systems via directory object manipulation and Volume Shadow Copy Service (VSS) interactions. The code dynamically resolves NTDLL functions and attempts to enumerate and manipulate shadow volume names.

The repository contains only a vague README with no technical details or exploit code, mentioning a 'threat hunting query' for CVE-2026-33825 without providing any actionable information.

This repository provides a detailed technical analysis and detection logic for a multi-stage attack chain involving Windows Update API abuse, Defender update package retrieval, and other suspicious activities. It includes KQL queries for Microsoft Defender XDR Advanced Hunting but does not contain functional exploit code.