The Windows Registry Adventure #5: The regf file format
Summary: Google Project Zero's Mateusz Jurczyk details the regf format that has encoded Windows registry hives since Windows NT 3.1 through Windows 11, a design that keeps the same representation on disk and in memory rather than reparsing between the two. He notes Microsoft has never released an official specification, that hive management accounts for only 10,407 of 100,007 decompiled registry lines in Windows 11 build 10.0.22621.2134, and that just two of 52 Microsoft-assigned registry CVEs touched Hv* functions: CVE-2022-37988 and CVE-2024-43452.
What you should know: The hive version field is not enforced at load time, and CVE-2022-38037 showed CmpSplitLeaf choosing a subkey list format from the version rather than the binary data itself - a reminder that a 30-year-old undocumented format still carries parsing assumptions an attacker can steer.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026