The DxgkDdiEscape handler for 0x7000170 lacks proper bounds checks for the variable size input escape data, and relies on a user provided size as the upper bound for writing output.

---

Filed under: exploit - @ October 31, 2016 11:54 pm