SecureAgePlus Driver Vulnerability PoCs (CVE-2026-11459: Arbitrary File Read/LPE)

Vulnerability Overview This repository contains proof-of-concept (PoC) projects targeting vulnerabilities identified in the SecureAge / SecureAgePlus driver components. These PoCs are intended for research, validation, and disclosure documentation and are retained after responsible disclosure to the vendor. The code is intended solely for defensive security purposes and should be used by authorized researchers, maintainers, or defenders in an isolated laboratory environment to expose vulnerabilities, reproduce vendor fixes, or study Windows driver vulnerability patterns. Scope of Impact Vendor: SecureAge Technology / SecureAgePlus Product/Component: SecureAge / SecureAgePlus Windows Driver Interface Affected Versions: 10.9.4 Remediation Fixed Version: 10.9.4 Project Details Arbitrary File Read (CVE-2026-11459) Description: A proof-of-concept demonstrating unauthorized file access behavior through the driver by interacting with the SecureAgePlus device interface. The project includes obtaining the device handle, sending file open/read requests via the driver’s IOCTL path, and writing the read file contents to an output file. SamSystemDump (CVE-2026-11459) Description: A proof-of-concept focused on verifying the driver-mediated file read behavior against a controlled test file path. It uses the same generic device interaction pattern and serves as a simplified reproduction tool for the affected file access logic. PoolOverflowLPE Description: A proof-of-concept involving a local privilege escalation path due to a pool overflow condition within the driver. The project demonstrates the vulnerability’s impact in a lab environment by constructing read/write primitives from corrupted kernel objects and verifying privilege escalation behavior. Build and Runtime Instructions Structure: The repository is organized as a Visual Studio solution containing separate C++ projects. Development Environment: Developed for Windows 11 25H2, expecting the affected SecureAge / SecureAgePlus drivers and device interfaces to be present on the test system. Dependencies: Successful reproduction depends on the exact product version, Windows build, driver layout, structure offsets, and local system state because these projects interact with kernel drivers. The code should be treated as research material, not a stable exploitation framework. Usage 1. Prepare Environment: Prepare an isolated Windows 11 25H2 test virtual machine. 2. Install Affected Version: Install the affected SecureAge / SecureAgePlus version for validation. 3. Verify Device Interface: Confirm that the SecureAgePlus device interface exists and is accessible for testing users. 4. Open Solution: Open in Visual Studio. 5. Select Project: Choose the project matching the behavior being validated: - : For driver-mediated file read behavior. - : For simplified file read reproduction. - : For local privilege escalation impact verification. 6. Build Project: Build the selected project for the target architecture used in the lab. 7. Run PoC: Execute the compiled PoC only within the prepared virtual machine. 8. Document Results: Record the product version, Windows build, observations, crash data (if any), and whether the vendor’s fix prevented reproduction. Security Considerations Purpose: PoCs are not intended for weaponization, persistence, evasion, unauthorized access, or deployment in production environments. Validation: When using this repository to validate fixes, prioritize using vendor patches and supported detection guidelines over running exploit code on live systems. Code Blocks Specific PoC code was not provided in the source page, so no code blocks can be extracted.

Goal Reached Thanks to every supporter — we hit 100%!

SecureAgePlus Driver Vulnerability PoCs (CVE-2026-11459: Arbitrary File Read/LPE)

More from this source