Wrote up CVE-2026-50416. win32k maps the desktop heap into every process. Offset 0x100 hands out a raw kernel session pool pointer. Readable from Low IL, AppContainer, even a zero capability LPAC. github.com/karollooool/CVE-2…

MSRC dismissed my LPE because it supposedly needs dev mode. Funny because I already sent them an updated working PoC without it like a month before they dismissed it. I appealed on Oct 15. but that obviously went into the void… There is still one small detail I’m not 100% sure about, but they didn’t even mention that in their dismissal either. And now today I managed to bypass what looks to me like a deliberate fix they introduced in build 29695.1001 (Oct 23) so it comes down to SYSTEM again… Like seriously, what the actual fuck are you trying to do here @msftsecresponse ? If anyone could connect me directly with someone from their team I would really appreciate it, because I just wanna get this sorted out already somehow. DMs are open.

It might sound crazy what I am about to say, but I would not treat this as the end of the story. I’ll leave it at that for now.

CVE-2026-83991: GENERIC_WRITE and DeleteFileW both return error 5. Same token, CfCreatePlaceholders with SUPERSEDE returns S_OK. Same file ID, new IO_REPARSE_TAG_CLOUD. Microsoft’s affected range goes back to 2018. Writeup: github.com/karollooool/CVE-2…