Stefan Schiller demonstrates how an arbitrary file-write vulnerability can lead to code execution in a Node.js application, even when the root filesystem and procfs are read-only and the application runs with low privileges.
Thomas Dubier demonstrates remote code execution in Neverwinter Nights via malformed multiplayer messages: a memory leak defeats ASLR, enabling an out-of-bounds write to overwrite a return address. He warns re-released games may retain old bugs and lack mitigations.
Researchers demonstrate an exploit chain that escapes a VMware Workstation guest and escalates privileges on the Windows host using information disclosure, use-after-free and kernel heap overflow vulnerabilities.
Meta researchers chained four fixed vulnerabilities in Messenger for Android to demonstrate one-click code execution, then used the exercise to develop application-hardening measures.
Researcher xerub traces the evolution of iOS security mitigations, their historical bypasses and the growing difficulty of building exploit chains, while recommending Lockdown Mode as a defense against attacks such as BLASTPASS.
Researchers demonstrated how firmware vulnerabilities and security misconfigurations on AMD-based laptops could enable persistent system management mode access after an operating system compromise.
NiNi explains how crafted IPv6 router advertisements exploited a stack buffer overflow in MikroTik RouterOS and how a race condition affected exploit reliability. The vulnerability was fixed.
Thomas Imbert and Thomas Bouzerar described a VirtualBox guest-to-host escape using a TPM-related stack overflow and information leak, followed by a Windows kernel-driver flaw that enabled escalation to SYSTEM.
Orange Tsai recounts three years of Sonos Pwn2Own research, including media-parser vulnerabilities, failed exploit attempts and a previously harmless code path that became exploitable after an update.
A researcher presents a template-based fuzzer for XNU Mach IPC, using generated C tests, mutation strategies and kernel-panic monitoring. The talk details kernel vulnerabilities and says Apple patched one in iOS 15.6.1.
Piotr Bazydło demonstrates deserialization and serialization gadget chains that bypass protections in SolarWinds, Exchange and Device Master, enabling code execution or information disclosure in test scenarios.
Stefan Schiller demonstrates how a Guacamole protocol parser mismatch can expose credentials and enable a use-after-free exploit, leading to code execution on the remote desktop gateway.
Leo Adrien explains how he reproduced a Hyper-V VMBus use-after-free that crashed the host, reported it to Microsoft and received a bounty. Microsoft classified the issue as remote code execution.
Simon Scannell demonstrated a research exploit chaining an out-of-bounds read and a heap overflow to achieve remote code execution against ClamAV in a Zimbra email-server setup.
A researcher demonstrated a DevFS time-of-check/time-of-use flaw in XNU that let an unprivileged macOS user gain root and bypass System Integrity Protection. Apple fixed the flaw in macOS 12.6.6 and iOS 16.5.
Charles Fol describes a pre-authentication remote-code-execution flaw in FortiGate SSL VPN, where an encrypted-parameter length-check error enables targeted memory modification. He reports that a red-team exploit captured enterprise credentials.
Researchers demonstrate a Qualcomm boot ROM flaw that uses repeated Sahara USB commands to gain privileged code execution and root a Pixel 3. They describe exploit development and mitigations in newer chipsets.
Junoh Lee and JeongOh Kyea describe a Windows kernel AFD Fast I/O integer-overflow bug triggered by racing changes to a user buffer, then explain a heap-overflow exploit strategy for local privilege escalation and demonstrate it on Windows 11.
Researchers demonstrated Fabius, a bypass that uses an existing read-write primitive to alter protected kernel behavior while Windows Memory Integrity is enabled. They said the method cannot load unsigned drivers or shellcode.
Researchers used WTF snapshot fuzzing to find an integer-overflow bug in the Windows software rasterizer that can cause an out-of-bounds write when an RDP client processes crafted graphics data. They reported it to Microsoft; it was fixed about four months later. No PoC
Thomas Chauchefoin presents Zimbra research covering email-triggered cross-site scripting, credential theft through cache poisoning, and server compromise through a flaw in archive extraction.
