The Drift Corpus: Ring 0

http.sys — Integer overflow in per-request array capacity (CWE-190) causing kernel pool overflow in UlpParseNextRequest fixed

KB5094127

KB published 2026-06-09

cea.sys — Integer overflow (CWE-190) leading to kernel pool buffer overflow (CWE-122) in EaSignalAggregatedEvent fixed

KB5082142

KB published 2026-04-14

dxgkrnl.sys — Use-After-Free (CWE-416) — missing reference count on DXGSHAREDVMOBJECT in DXG_HOST_REMOTEOBJECTCHANNEL::ProcessChannelMessage fixed

KB5073724

KB published 2026-01-13

fcvsc.sys — untrusted host transaction ID dereferenced as kernel SRB pointer (CWE-822) fixed

KB5073723

KB published 2026-01-13

http.sys — TOCTOU double-fetch leading to kernel memory disclosure (CWE-367, CWE-200) in UlGenerateTrailers fixed

KB5087420

KB published 2026-05-12

afd.sys — missing output-buffer bounds check on accepted-connection transport-address copy in AfdSanAcceptCore (CWE-120) fixed

KB5075912

KB published 2026-02-10

csvflt.sys — Race Condition (CWE-362) leading to Use-After-Free (CWE-416) in CsvCamSetSecurityInfo fixed

KB5078752

KB published 2026-03-10

csvfs.sys — TOCTOU Race Condition / Use-After-Free (CWE-362, CWE-416) in CsvCamSetSecurityInfo fixed

KB5078752

KB published 2026-03-10

csvnsflt.sys — Use-After-Free race from unlocked global reads in CsvCamSetSecurityInfo (CWE-416, CWE-362) fixed

KB5078752

KB published 2026-03-10

disk.sys — Out-of-bounds read (CWE-125) and out-of-bounds write (CWE-787) in SCSI mode page parsing fixed

KB5094128

KB published 2026-06-09

dxgkrnl.sys — Race condition (insufficient lock strength) leading to double-free / use-after-free in DXGSWAPCHAIN swapchain sync-object teardown (CWE-362) fixed

KB5078885

KB published 2026-03-10

http.sys — Double-fetch / TOCTOU on user-supplied trailer source pointer (CWE-367) in UlGenerateTrailers fixed

KB5077181

KB published 2026-02-10

afd.sys — Integer underflow in accept options copy leading to kernel pool buffer overflow (CWE-191) fixed

KB5094122

KB published 2026-06-09

afd.sys — Out-of-bounds write (CWE-787) in SAN accept address handling and out-of-bounds read (CWE-125) in super-accept address retrieval fixed

KB5087537

KB published 2026-05-12

afd.sys — Out-of-bounds write via missing 10-byte header reservation (CWE-787) in AfdRestartSuperAcceptGetAddress fixed

KB5082123

KB published 2026-04-14

cea.sys — integer overflow leading to pool buffer overflow in EaSignalAggregatedEvent (CWE-190) fixed

KB5094128

KB published 2026-06-09

afd.sys — Out-of-bounds read/write via feature-gated length clamp in AfdRestartSuperAcceptGetAddress (CWE-787) fixed

KB5073722

KB published 2026-01-13

ccffilter.sys — Out-of-bounds read due to inverted bounds check (CWE-125, CWE-697) in CCFFilterAppInstanceEA fixed

KB5073723

KB published 2026-01-13

cdfs.sys — integer overflow leading to kernel pool buffer overflow (CWE-190, CWE-122) in CdAddAllocationFromDirent fixed

KB5073723

KB published 2026-01-13

csvvbus.sys — Use-after-free from unsynchronized EncryptionManager access (CWE-416) fixed

KB5073723

KB published 2026-01-13

http.sys — Out-of-bounds access via missing QPACK ordinal validation (CWE-787, CWE-125) in QkIsOrdinalUseable fixed

KB5074109

KB published 2026-01-13

mrxsmb.sys — Use-after-free read of VNetRoot context in tree-connect completion (CWE-416), mitigated behind a feature flag

KB5089549

KB published 2026-05-12

mrxsmb.sys — Use-after-free read of VNetRoot context in tree-connect completion (CWE-416), mitigated behind a feature flag

KB5089549

KB published 2026-05-12

msnfsflt.sys — Uninitialized kernel stack memory leaked through NFS server-call record (CWE-908) fixed

KB5078752

KB published 2026-03-10

ndis.sys — NDIS open-block reference-count use-after-free race and interface-alias integer-underflow out-of-bounds read (CWE-416/CWE-125) fixed

KB5077181

KB published 2026-02-10

ntfs.sys — Feature-gated bounds/size validation in $LogFile restart-table recovery made unconditional (CWE-787) — fixed

KB5082123

KB published 2026-04-14

ntfs.sys — $LogFile restart-table validation and integer-overflow checks made unconditional (CWE-20, CWE-190) — feature gate removed, fixed

KB5087538

KB published 2026-05-12

pci.sys — Missing MSI-X capability validation and dangling IO-mapping pointer causing double MmUnmapIoSpace (CWE-20, CWE-825) fixed

KB5087545

KB published 2026-05-12

http.sys — Feature-gated HTTP header-count resource limit (CWE-400) and 16-bit buffer-growth integer-overflow guard (CWE-190), fixed

KB5093998

KB published 2026-06-09

hvsocket.sys — Feature-gated missing spinlock synchronization in VmbusTl loopback delivery queue (CWE-362/CWE-416) fixed

KB5078885

KB published 2026-03-10

hvsocket.sys — VMBus loopback endpoint spinlock conditionally skipped behind a feature gate, allowing an unsynchronized access race (CWE-362) — fixed by making locking unconditional

KB5082123

KB published 2026-04-14

hvsocket.sys — Feature-gated loopback endpoint use-after-free / race in teardown (CWE-416/CWE-362) fixed

KB5078752

KB published 2026-03-10

hvsocket.sys — Use-after-free / race on loopback socket endpoint access (CWE-416 / CWE-362) fixed by removing a feature gate and making reference-counted endpoint access unconditional

KB5087538

KB published 2026-05-12

ksecdd.sys — NULL-pointer dereference & missing ProbeForRead in SSPI dispatch and IOCTL paths (CWE-476, CWE-822) fixed

KB5094128

KB published 2026-06-09

ksecpkg.sys — Missing minimum-length validation before TLS/DTLS record header reads (CWE-125) fixed

KB5094128

KB published 2026-06-09

mrxsmb.sys — Read-after-free of VNetRoot device-object pointer in tree-connect completion (CWE-416) fixed

KB5094127

KB published 2026-06-09

mssecflt.sys — Use-after-free during process-context enumeration under shared lock (CWE-416) fixed

KB5078752

KB published 2026-03-10

ataport.sys — Use-after-free fix in `IdePortTickHandler`: periodic tick now holds the device remove lock (plus an unrelated ATA error-retry refactor)

KB5082142

KB published 2026-04-14

ccffilter.sys — ECP lifetime use-after-free / double-free in CCFPreCreate (CWE-416) fixed

KB5078752

KB published 2026-03-10

ci.dll — trust bypass / missing validation (CWE-358) in SIPolicyIsPolicyPlatformSecured fixed

KB5079473

KB published 2026-03-10

ci.dll — Security-relevant change: custom-kernel-signer trust-decision hardening (CWE-863), plus SymCrypt ML-DSA termination hardening

KB5095051

KB published 2026-06-09

cldflt.sys — Missing authorization on feature-gated sync-root disconnect and insert (CWE-862) fixed

KB5078885

KB published 2026-03-10

cldflt.sys — Missing sign/bounds/overflow validation of file-range values on cloud-files control paths (CWE-20) made unconditional; fixed

KB5094127

KB published 2026-06-09

condrv.sys — Use-After-Free (CWE-416) due to premature object reference release in CdCreateDefaultObjectClient fixed

KB5078752

KB published 2026-03-10

dxgmms2.sys — Improper synchronization / EX_PUSH_LOCK self-deadlock (CWE-662) in CVirtualAddressAllocator::AddVaRangeToVadRangeListWithFix fixed

KB5078885

KB published 2026-03-10

dxgmms2.sys — Use-After-Free (CWE-416) in VidSchiAddPendingCommandToSyncPointList fixed

KB5094127

KB published 2026-06-09

exfat.sys — Improper input validation of negative file size/offset in IRP_MJ_SET_INFORMATION handlers (CWE-20) fixed

KB5094127

KB published 2026-06-09

hvsocket.sys — One delivered security fix: an unconditional connection-establishment race hardening (CWE-362) in the AF_HYPERV connect() path (VmbusTlProviderConnect); the originally-claimed socket-address/authorization bypass remains a false positive (validation identical in both builds)

KB5094128

KB published 2026-06-09

afd.sys — Pending IRPs left queued on a recycled connection during AFD SAN teardown (CWE-416) fixed

KB5078752

KB published 2026-03-10

afd.sys — Use-after-free hardening via reference-count integrity fastfail checks (CWE-416) fixed

KB5087545

KB published 2026-05-12