Windows Exploitation Tricks: Trapping Virtual Memory Access
Summary: Google Project Zero's James Forshaw describes a Windows exploitation trick that traps access to virtual memory, gets feedback when it occurs, and delays access indefinitely, succeeding mostly on the latest Windows 10 versions. The technique targets double-fetch TOCTOU vulnerabilities, where code reads a value such as a buffer length, verifies it, then rereads it before use, and he focused on SMB and WebDAV as the two MUP file systems enabled by default and trivially usable.
What you should know: Double-fetch flaws can yield privilege escalation or information disclosure, and the prior probabilistic exploits needed two racing threads and struggled on single-core machines; a primitive that can delay a memory access indefinitely turns that race into a near-certainty for an attacker.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026