Using Binary Diffing to Discover Windows Kernel Memory Disclosure Bugs

Summary: Google Project Zero's Mateusz Jurczyk used binary diffing of decompiled Windows 7, 8.1 and 10 kernels to count memset calls in top-level syscall handlers, finding 8 ntoskrnl and 16 win32k syscall handlers in Windows 7 with new memset usage versus Windows 10, and 5 and 11 respectively for Windows 8.1. The diff surfaced two uninitialized kernel memory disclosure bugs - win32k!NtGdiGetFontResourceInfoInternalW (CVE-2017-8684), a stack disclosure of about 0x5c (92) bytes, and win32k!NtGdiEngCreatePalette (CVE-2017-8685) - both fixed in the September Patch Tuesday.
Why it matters: Microsoft silently fixed these flaws in Windows 10 while leaving Windows 7 and 8 exposed, and Windows 7 still held nearly 50% of the desktop market at the time of writing - so users of the older systems carried a false sense of security against bugs detectable just by spotting code changes across versions.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026