Download
This is a proof of concept for CVE-2021-31166 ("HTTP Protocol Stack Remote Code Execution Vulnerability"), a use-after-free dereference in http.sys patched by Microsoft in May 2021. The bug itself happens in http!UlpParseContentCoding where the function has a local LIST_ENTRY and appends an item to it. When it's done, it moves it into the Request structure; but it doesn't NULL out the local list. The issue with that is that an attacker can trigger a code-path that frees every entry of the local list leaving them dangling in the Request object.
Features
- HTTP Protocol Stack Remote Code Execution Vulnerability
- Use-after-free dereference in http.sys patched by Microsoft in May 2021
- Bugcheck defined
- Remote HTTP.sys use-after-free triggered remotely
Project Samples
License
MIT LicenseFollow CVE-2021-31166
Other Useful Business Software
Go From AI Idea to AI App Fast
Access Gemini 3 and 200+ models. Build chatbots, agents, or custom models with built-in monitoring and scaling.
Rate This Project
Login To Rate This Project
User Reviews
Be the first to post a review of CVE-2021-31166!
