Windows Exploitation Tricks: Abusing the User-Mode Debugger

Summary: Google Project Zero's James Forshaw documented a mismatch in Windows debugging: the Win32 DebugActiveProcess API opens a target process with PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION and PROCESS_SUSPEND_RESUME, but the kernel's NtDebugActiveProcess only checks for PROCESS_SUSPEND_RESUME. Because DbgkpOpenHandles calls ObOpenObjectByPointer in KernelMode with PROCESS_ALL_ACCESS and THREAD_ALL_ACCESS, a caller holding only PROCESS_SUSPEND_RESUME can obtain full-access handles to the debugged process and its initial thread via NtWaitForDebugEvent.
What's compelling: Forshaw notes PROCESS_SUSPEND_RESUME is itself a write access, so any bug leaking it to a privileged process would likely also leak PROCESS_CREATE_THREAD or PROCESS_VM_WRITE - meaning the debugger path is a secondary route to full process control rather than a standalone escalation.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026