Windows Exploitation Tricks: Spoofing Named Pipe Client PID
Summary: Project Zero's James Forshaw documented techniques for spoofing the client PID that Windows named pipe servers read through the GetNamedPipeClientProcessId API, a feature introduced in Vista and used by some third-party software, including Check Point Anti-Virus, to enforce security checks. The PID is set by the named pipe file system driver when a client connects, and Forshaw showed it can be spoofed by opening a pipe through the local SMB server and an NTFS mount point with a crafted extended attribute buffer, by cycling process IDs against the fixed SMB value 65279/0xFEFF, or by opening the pipe in one process and duplicating the handle to another.
Why it matters: Any application that treats the named pipe client PID as proof of identity, as Check Point Anti-Virus did, can be made to see a process the attacker controls instead of the real caller, which bypasses the check entirely. Forshaw's mount-point technique still works on Windows 10 1709 and later despite the CVE-2018-0749 fix, and the PID-cycling variant works on all versions of Windows.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026