karollol

Wrote up CVE-2026-50416. win32k maps the desktop heap into every process. Offset 0x100 hands out a raw kernel session pool pointer. Readable from Low IL, AppContainer, even a zero capability LPAC. github.com/karollooool/CVE-2…

I'm usually not the type to argue about dupes, I just take them like a good boy and move on. But this time I actually want an explanation. I'm not gonna pretend the bounty doesn't matter, but at this point I care more about getting the full timeline and a proper explanation. I just want clarity. I reported my LPE to MSRC back in JULY. Spent over 3 months waiting just for them to dismiss it over Developer Mode, even tho I already updated the PoC to work without it before they dismissed it. Oct 27 I sent them another working PoC on a newer build that contains an unusually specific sig check. Same day I called them out publicly and they even DMed me saying they asked their team to take another look. Oct 28 they finally announce a secondary review and literally ONE DAY later its suddenly a duplicate??? Back when I was selling game cheats I genuinely got more professional handling from cheat resellers/staff I used to deal with than from MSRC. FROM PEOPLE SELLING GAME CHEATS. If it was a duplicate all along, then why did you let my report sit for months, argue about Developer Mode, and then after I got around what looks like deliberate security hardening, suddenly mark it as a dupe two days later instead of telling me that in the first place? The root cause was there since my initial submission, so why not mark it as a dupe right off the bat?

MSRC dismissed my LPE because it supposedly needs dev mode. Funny because I already sent them an updated working PoC without it like a month before they dismissed it. I appealed on Oct 15. but that obviously went into the void… There is still one small detail I’m not 100% sure about, but they didn’t even mention that in their dismissal either. And now today I managed to bypass what looks to me like a deliberate fix they introduced in build 29695.1001 (Oct 23) so it comes down to SYSTEM again… Like seriously, what the actual fuck are you trying to do here @msftsecresponse ? If anyone could connect me directly with someone from their team I would really appreciate it, because I just wanna get this sorted out already somehow. DMs are open.

It might sound crazy what I am about to say, but I would not treat this as the end of the story. I’ll leave it at that for now.

CVE-2026-83991: GENERIC_WRITE and DeleteFileW both return error 5. Same token, CfCreatePlaceholders with SUPERSEDE returns S_OK. Same file ID, new IO_REPARSE_TAG_CLOUD. Microsoft’s affected range goes back to 2018. Writeup: github.com/karollooool/CVE-2…