The DxgkDdiEscape handler for 0x600000D passes an unchecked user provided pointer as the destination for a memcpy call. This leads to kernel memory corruption.

---

Filed under: exploit - @ October 31, 2016 11:54 pm