https://inflearner0.github.io/inflearnerA technical blog about software development, tools, and continuous learning. 2026-08-29T19:18:27+00:00 inflearner https://inflearner0.github.io/ Jekyll © 2026 inflearner /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png CVE-2026-50313 — Windows NTFS Remote Code Execution Vulnerability: Patch-Diffing an $EA Out-of-Bounds Read2026-08-17T18:00:00+00:00 2026-08-18T14:42:22+00:00 https://inflearner0.github.io/posts/ntfs-ea-oob-read-patch-diff/ inflearner Microsoft shipped four NTFS remote-code-execution CVEs in the July 2026 cumulative update. All four landed in the same binary, on the same day, in the same 1,792 bytes of new .text. That is a gift: one patch, four bugs, and no vendor guidance about which change belongs to which CVE. This is a writeup of pulling that patch apart, finding one of the bugs, and then proving it end to end on a live... CVE-2026-61346 — Windows Graphics Kernel Elevation of Privilege Vulnerability: A Missing `lock` Prefix2026-04-17T15:00:00+00:00 2026-08-18T14:42:22+00:00 https://inflearner0.github.io/posts/dxgkrnl-flip-refcount-uaf/ inflearner Some vulnerabilities take a week to find. This one is a single missing instruction prefix, and once you are looking at the right three instructions it is impossible to miss. CVE-2026-61346 is a use-after-free in the Windows Graphics Kernel, patched on 11 August 2026. Microsoft’s advisory is four lines long and the interesting part is buried in an FAQ entry: “successful exploitation of this vul... The Vulnerable Password Manager: Four Leaks, One Format String, and a Ring 0 ROP Chain2026-03-17T04:30:00+00:00 2026-03-17T04:30:00+00:00 https://inflearner0.github.io/posts/vulnerable-password-manager/ inflearner Somebody wrote a password manager and put it in the kernel. That sentence is the whole vulnerability class, but the driver in front of me is more interesting than that joke deserves. It is about 8 KB, it exposes three IOCTLs on \\.\pwvault, it keeps its entries in a doubly linked list in the non-paged pool, and it hashes every password with SHA-512 before storing it. Somebody was trying. This... Welcome to the Blog2026-02-10T11:00:00+00:00 2026-02-10T11:00:00+00:00 https://inflearner0.github.io/posts/welcome-to-the-blog/ inflearner Hi, I’m inflearner. Welcome to my technical blog. This is where I share what I learn and build, with a focus on reverse engineering and software engineering. You can expect posts about topics such as: Analyzing how software works under the hood Reverse-engineering tools, techniques, and discoveries Software architecture and development practices Technical experiments, tutorials, and...