The Windows Registry Adventure #8: Practical exploitation of hive memory corruption

This Project Zero blog post analyzes Windows registry (regf/hive) memory corruption bugs and demonstrates a complete, deterministic exploitation chain on Windows 11: from triggering a hive use-after-free to crafting controlled registry values, disabling a bounds check, leaking kernel bases, creating self-referential registry values to obtain arbitrary kernel read/write via Regedit, and finally stealing the SYSTEM token to achieve privilege escalation. The write-up details multiple exploitation approaches (intra-hive, pool corruption, inter-hive), a chosen PoC vulnerability (CVE-2023-23420) with step-by-step exploit construction, root causes, and proposed mitigations such as moving the cell-index check earlier in the code.