Our Research

CVE-2026-13043 Kernel Memory Access

CVE-2026-13043 Kernel Memory Access

Juan Sacco

Discovered by: Juan Sacco  Vendor: Panda Antivirus Security / WatchGuard  Component: Panda Kernel Memory Access Driver  Driver module: pskmad.sysCVE: 2026-13043 CVSS Score: 9.3Link: https://psirt.watchguard.com/CVE-2026-13043 CVE Summary A missing authentication vulnerability in...

CVE-2026-13043 Kernel Memory Access

Juan Sacco

Discovered by: Juan Sacco  Vendor: Panda Antivirus Security / WatchGuard  Component: Panda Kernel Memory Access Driver  Driver module: pskmad.sysCVE: 2026-13043 CVSS Score: 9.3Link: https://psirt.watchguard.com/CVE-2026-13043 CVE Summary A missing authentication vulnerability in...

Subverting the Windows Kernel: Juan Sacco's Research Presented at BruCON 2026

Subverting the Windows Kernel: Juan Sacco's Res...

Mara Isaacson

At BruCON 2026, the principal developer of Exploit Pack, Juan Sacco, presented Subverting the Windows Kernel: When VBS, HVCI and kCET Are Enabled, a research talk exploring the limitations of modern Windows kernel...

Subverting the Windows Kernel: Juan Sacco's Res...

Mara Isaacson

At BruCON 2026, the principal developer of Exploit Pack, Juan Sacco, presented Subverting the Windows Kernel: When VBS, HVCI and kCET Are Enabled, a research talk exploring the limitations of modern Windows kernel...

From Integer Overflow to Arbitrary Kernel VA Read/Write: CVE-2026-62735 in HTTP.sys

From Integer Overflow to Arbitrary Kernel VA Re...

Juan Sacco

By Juan Sacco from Exploit Pack <jsacco@exploitpack.com> While researching the latest Pwn2Own disclosures, I came across CVE-2026-62735, an integer-overflow vulnerability in HTTP.sys, the Windows kernel HTTP protocol stack. The vulnerability...

From Integer Overflow to Arbitrary Kernel VA Re...

Juan Sacco

By Juan Sacco from Exploit Pack <jsacco@exploitpack.com> While researching the latest Pwn2Own disclosures, I came across CVE-2026-62735, an integer-overflow vulnerability in HTTP.sys, the Windows kernel HTTP protocol stack. The vulnerability...

Asustek Kernel Driver Asio3.sys 0-day vulnerability

Asustek Kernel Driver Asio3.sys 0-day vulnerabi...

Juan Sacco

While researching the ASUS AsIO and AsIO2 driver families, I focused on their relevance and PA capabilities. Both are signed kernel drivers with privileged hardware-access capabilities, and applicable builds can...

Asustek Kernel Driver Asio3.sys 0-day vulnerabi...

Juan Sacco

While researching the ASUS AsIO and AsIO2 driver families, I focused on their relevance and PA capabilities. Both are signed kernel drivers with privileged hardware-access capabilities, and applicable builds can...

Abusing VBS Enclaves: Data-Only Execution and VTL1-Backed Process Hollowing

Abusing VBS Enclaves: Data-Only Execution and V...

Juan Sacco

By Juan Sacco from Exploit Pack Interested in Windows Kernel? Check out our Technical Training Courses. What happens when an untrusted VTL0 host gains read/write access to a VBS enclave,...

Abusing VBS Enclaves: Data-Only Execution and V...

Juan Sacco

By Juan Sacco from Exploit Pack Interested in Windows Kernel? Check out our Technical Training Courses. What happens when an untrusted VTL0 host gains read/write access to a VBS enclave,...

Global Descriptor Table Hijacking in Windows 11

Global Descriptor Table Hijacking in Windows 11

Juan Sacco

Interested in Windows Kernel? Check out our Technical Training Courses We have demonstrated how DOG, our Data Only Gadgets tooling inside EP3, can use existing kernel read/write primitives to redirect...

Global Descriptor Table Hijacking in Windows 11

Juan Sacco

Interested in Windows Kernel? Check out our Technical Training Courses We have demonstrated how DOG, our Data Only Gadgets tooling inside EP3, can use existing kernel read/write primitives to redirect...

Technical Training