Loading vulnerability…
CVE-2022-26809 is a critical remote code execution vulnerability in the Windows Remote Procedure Call (RPC) Runtime, associated with the rpcrt4.dll library. Available technical analysis indicates the flaw involves an integer overflow in RPC packet-processing logic that can lead to a subsequent heap buffer overflow. Referenced vulnerable code paths include RPC response and buffer coalescing routines such as OSF_CCALL::ProcessResponse, OSF_CCALL::ProcessResponsePDU, OSF_SCALL::GetCoalescedBuffer, and OSF_CCALL::GetCoalescedBuffer. Because the vulnerable routines are present in RPC processing on both client and server sides, a specially crafted RPC message can trigger memory corruption in the context of the RPC process. The vulnerability has been described as zero-click and unauthenticated under exposed conditions.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (5 hidden).
This repository contains a collection of proof-of-concept (PoC) exploits and research tools for Windows DCE/RPC vulnerabilities, specifically CVE-2022-26809 and CVE-2021-36942 (PetitPotam). The main exploit, 'PetitPotam/petitpotam.py', is a Python script that coerces NTLM authentication from Windows hosts by abusing EFS-RPC methods over named pipes (such as 'lsarpc'). The exploit can force a Windows system to authenticate to an attacker-controlled SMB server, enabling credential capture or relay attacks. The repository also includes a fake SMB server implementation ('attacker-server/fake_smb_server.py'), a custom RPC implementation ('attacker-server/rpcrt.py'), and a C-based RPC demo ('pipedemo' directory) for further research and testing. The PoC demonstrates network-based attack vectors, requiring the attacker to be able to communicate with the target over the network (typically TCP port 445 or a custom RPC port). The exploit is not weaponized but provides a working proof-of-concept for security research and red teaming. The repository targets unpatched Microsoft Windows systems vulnerable to the specified CVEs.
This repository contains a single Python proof-of-concept exploit (PoC_CVE_2022_26809.py) and a README. The exploit targets CVE-2022-26809, a critical integer overflow vulnerability in Microsoft Windows RPC over SMB named pipes. The PoC is written in Python and leverages the Impacket library, with custom overrides to manipulate packet fragmentation and trigger the vulnerability. The exploit works by sending a very large number of crafted RPC fragments to the target's SMB named pipe endpoint, aiming to overflow a 32-bit integer and cause a heap buffer overflow in the RPC service. The README provides context, limitations, and references to vulnerable/patched server code. The exploit is a proof-of-concept and is not fully weaponized; it is intended for research and learning about RPC internals and the vulnerability. No hardcoded endpoints are present; the target IP and named pipe are provided as arguments at runtime.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Unknown
A vulnerability used as bait in a fake proof-of-concept repository; the content states the sample does not actually exploit the vulnerability and instead delivers malware.
A specific Windows vulnerability for which the content discusses checking whether the relevant security update has been installed using Osquery and Windows KB patch IDs.
A critical unauthenticated zero-click remote code execution vulnerability in the Windows RPC runtime (rpcrt4.dll), caused by an integer overflow that can lead to a heap buffer overflow.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.