Skip to content
KitploitKITPLOIT
ToolsBlog
Log in
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/loanvui/cve-2026-62737
Vulnerability AnalysisExploitationBinary Exploitation
GitHubloanvui/cve-2026-62737

CVE-2026-62737

PowerShell proof-of-concept that triggers CVE-2026-62737, an arbitrary kernel call in ExecutionContext.sys, causing a controlled kernel crash on Windows 11.

View Repository
31191 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-62737 — ExecutionContext.sys Arbitrary Kernel Call

Proof of concept for CVE-2026-62737: ExecutionContext.sys invokes a user-controlled TaskFn pointer in kernel mode without validation, producing a controlled kernel crash.

Validated on stock Windows 11 25H2 (build 26200.8655, ARM64): 0x7E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED, with the faulting RIP set to the PoC's controlled TaskFn marker.

The same script did not crash an unmodified Windows 11 24H2 system (build 26100.5074, x64) because Windows kept the vulnerable kernel path disabled behind an internal feature flag. In a separate lab-only test, we manually changed that flag in live kernel memory and then observed a 0x50 crash. Because that test modified the running kernel, it is not a stock 24H2 reproduction.

This PoC demonstrates the arbitrary kernel-call primitive and a kernel DoS.

Self-contained PowerShell script using C# Add-Type; supports x64 and ARM64.

Download Tool