CVE_2026_40369 Exploit

poc and exp for CVE_2026_40369, related to my analyze, use cmake.

Debug code, poc and exp files for reproducing CVE_2026_40369, written with cmake. As before, you can compile it directly using the regular cmake commands.

About the analysis article:

• WeChat Official Account: https://mp.weixin.qq.com/s/jUEW6MPkWhmxt_8w2Oszhg
• My blog: https://joe1sn.eu.org/2026/05/30/CVE-2026-40369

Maybe our WeChat Official Account < 不止Sec > has more content you might be interested in

Note

[2026-7-23]: Tried to bypass kASLR with the prefetch tool, but it still has a high probability of causing a blue screen, and in real engagements it basically cannot land.

• Exploitation requires leaking the base address of ntoskrl.exe in advance, which is difficult on 25H2. So my/original exp needs to be set manually.
• This technique can only be triggered once, because it is a lossy self-increment with no fixed value, so it may later fail to locate the CmpLayerVersions address. Alternatively, you can also use a different version information location to construct the victim fake chunk.
• It uses the remote thread injection technique, which may not pass antivirus detection, greatly shrinking the attack surface.
• In my exp, you may need to modify offsets for different system versions; the offsets are in include\common\gadget.hpp.
• My exp does not restore the value of CmpLayerVersionCount, although I think it does not matter.