The Windows Registry Adventure #8: Practical exploitation of hive memory corruption

Mateusz Jurczyk (Google Project Zero) presents an in-depth analysis of Windows registry hive memory corruption and step‑by‑step exploitation techniques targeting hive-based bugs. The report explains allocator/mapping behavior, multiple exploitation avenues (intra-hive data manipulation, pool corruption, inter-hive overflows), and details a deterministic OOB cell-index primitive to gain arbitrary kernel read/write via controlled registry values; it culminates in a proof-of-concept privilege escalation to SYSTEM on Windows 11 and discusses mitigations.