EIP-2026-115799

This exploit leverages a race condition in the NtQueryVirtualMemory system call to disclose kernel-mode Paged Pool allocation addresses. It uses two threads to exploit the 'double write' vulnerability, allowing the leakage of kernel pointers.