The Windows Registry Adventure #8: Practical exploitation of hive memory corruption

Summary: Google Project Zero's Mateusz Jurczyk details how hive-based registry memory corruption can be exploited to elevate a regular user from Medium IL to system-level privileges on Windows 11 while bypassing modern mitigations. He notes the registry cell allocator lacks corruption safeguards and randomness, and that of his 17 hive memory corruption cases, only 8 could be triggered solely through API operations on an existing hive, with just CVE-2023-23420 and CVE-2023-23423 well suited for directly attacking a system hive.
Key Takeaway: Jurczyk found roughly 1,678 keys under HKLM that grant subkey creation rights to normal users on a current Windows 11 system, 1,660 of them in HKLM\SOFTWARE, giving an attacker ample writable footholds inside the hives that hold system configuration and service registrations.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026