[GHSA-8gh5-q362-whfc] Double free in Windows Kernel allows an authorized...#8798
Open
nikosecurity wants to merge 1 commit into
Open
Conversation
github-actions
Bot
changed the base branch from
main
to
nikosecurity/advisory-improvement-8798
July 24, 2026 01:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
Comments
Since this is my CVE, I wanted to try and clarify a few details that MSRC's advisory was inaccurate about. The CVSS that the Zero Day Initiative provided for this vulnerability is lower, but notes that this vulnerability leads to a scope change. In particular, you could use this vulnerability to execute code within Virtual Trust Level 1 (VTL1)'s secure kernel, which is a separate virtual partition from the base NT kernel, being VTL0 (with some referring to it as the "normal" world). As for the description, it is rather vague as there are many kernel components within the Windows kernel that are simply bundled under the "Windows Kernel" component umbrella, and I would like to make clarifications about the exact component this affects rather than keeping it vague.
I also would like to add the ZDI advisory and my proof-of-concept code to the list of references, as the ZDI advisory provides additional helpful details about the vulnerability, and my proof-of-concept code demonstrates how one can trigger the vulnerability as a kernel driver.
Lastly, I would like to mention that I cannot submit this improvement request without selecting an ecosystem and Windows does not appear. The selected ecosystem should be ignored as it is unrelated to this vulnerability.