The Drift Corpus: Ring 0

afd.sys — Race condition on endpoint dispatch-pointer swap in AfdTLListenComplete (CWE-362) fixed

KB5082198

KB published 2026-04-14

afd.sys — Out-of-bounds write in AfdSanAcceptCore SAN transport-address copy (CWE-787) fixed

KB5075999

KB published 2026-02-10

agrsm64.sys — Missing authorization on a world-reachable modem control device with unchecked IOCTL dispatch (CWE-862) fixed

KB5075912

KB published 2026-02-10

cdrom.sys — Request IRP AssociatedIrp.SystemBuffer left dangling after synchronous forward in RequestHandleVolumeOnline (CWE-459) fixed

KB5078752

KB published 2026-03-10

ci.dll — Unchecked return value in ML-DSA secret-vector expansion (CWE-252/CWE-754) fixed

KB5083768

KB published 2026-04-14

iorate.sys — Integer overflow in I/O rate-limit accounting bypasses Storage QoS throttling (CWE-190) fixed

KB5073723

KB published 2026-01-13

kbdclass.sys — KernelMode RequestorMode bypass of the SeTcbPrivilege check in KeyboardClassCreate (CWE-863) fixed

KB5073723

KB published 2026-01-13

l2bridge.sys — Missing ProbeForRead on Fast I/O IOCTL handler dereferences an untrusted user pointer (CWE-125), now fixed

KB5073723

KB published 2026-01-13

lan7800.sys — receive-processing loop race with USB selective suspend (CWE-416) fixed

KB5073723

KB published 2026-01-13

mrxdav.sys — Uninitialized FCB field returned as NumberOfLinks in FileStandardInformation (CWE-908) info disclosure fixed

KB5073723

KB published 2026-01-13

mrxsmb.sys — Use-after-free via missing zero-check on VcEndpoint reference during SMB negotiate handling (CWE-416) fixed

KB5075912

KB published 2026-02-10

bcmdhd63.sys — out-of-bounds read / information disclosure in the status-indication path (CWE-125, CWE-200) fixed

KB5073723

KB published 2026-01-13

bowser.sys — Uninitialized paged-pool memory disclosure to user mode (CWE-908, CWE-200) in BowserAllocateName / AddBowserName / AsyncCreateTransportName fixed

KB5073723

KB published 2026-01-13

clusdisk.sys — Exclusive lock held across a subsystem callback in Pool::PendDefenseIrp (CWE-662) fixed

KB5073723

KB published 2026-01-13

dam.sys — Kernel object reference leak (CWE-404) and NULL pointer dereference (CWE-690) in DampIoDispatch fixed

KB5073723

KB published 2026-01-13

fbwf.sys — pool out-of-bounds write from unaccounted stream-name append in FbwfGenerateFileName (CWE-787) fixed

KB5073723

KB published 2026-01-13

fsdepends.sys — Missing authorization / access check (CWE-862) in DepFSPreCreate fixed

KB5073723

KB published 2026-01-13

hidusb.sys — integer underflow leading to out-of-bounds read (CWE-191, CWE-125) in HumParseHidInterface fixed

KB5073723

KB published 2026-01-13

mrxsmb.sys — Race on a not-fully-initialized session entry during concurrent tree-connect (CWE-476) local denial of service, fixed

KB5083768

KB published 2026-04-14

mrxsmb.sys — Race on a not-fully-initialized session entry during concurrent tree-connect (CWE-476) local denial of service, fixed

KB5083768

KB published 2026-04-14

msircomm.sys — Uninitialized PagedPool device-name buffer zeroed before IoGetDeviceProperty (CWE-908), defense-in-depth hardening fixed

KB5078752

KB published 2026-03-10

ndis.sys — Out-of-bounds read in receive-path Ethernet/SNAP parsers (CWE-125), fixed

KB5078883

KB published 2026-03-10

ntfs.sys — Negative file size/offset accepted in NtSetInformationFile handlers (CWE-839) fixed

KB5078885

KB published 2026-03-10

http.sys — Unsafe direct user-mode reads in legacy send/capture paths hardened with safe-capture primitives (CWE-822) fixed

KB5079473

KB published 2026-03-10

http.sys — Missing destination size cap on network-address copy in UlpCopyNetworkAddress (CWE-787) fixed

KB5089549

KB published 2026-05-12

http.sys — No delivered security fix: feature-staged double-fetch mitigation in UlGenerateTrailers, vulnerable path retained behind UxKir gate

KB5075941

KB published 2026-02-10

hvcrash.sys — Uninitialized stack bytes in crash-dump writer descriptor (CWE-908) zeroed / fixed

KB5078752

KB published 2026-03-10

hypervideo.sys — Uninitialized 7th argument to VMBus channel send on the bugcheck-display path (CWE-908) fixed

KB5078752

KB published 2026-03-10

ksrext.sys — Integer overflow in soft-reboot partition-restore allocation (CWE-190) removed and restore error path hardened to fail-fast; fixed

KB5094128

KB published 2026-06-09

ksrext.sys — rebuild/refactor: secure-call page-chain format addition, unlock-path consolidation, boot-restore database-lock hardening

KB5078752

KB published 2026-03-10

luafv.sys — Missing synchronization on LuafvQueryStoreDirectory stream-handle-context lazy init (CWE-362), fixed behind a staged feature gate

KB5094127

KB published 2026-06-09

modem.sys — Missing zero-initialization of PDO-name pool buffer in ModemHandleSymbolicLink (CWE-908) fixed

KB5078752

KB published 2026-03-10

modemcsa.sys — Uninitialized kernel stack buffer sent in KS streaming-state IOCTL (CWE-908) fixed

KB5078752

KB published 2026-03-10

msrpc.sys — Endpoint-map lookup tower-count clamp made unconditional (CWE-125), out-of-bounds free-loop hardening fixed

KB5094127

KB published 2026-06-09

msseccore.sys — Insufficient required signing level in the kernel-integrity check callback (CWE-347) fixed

KB5078885

KB published 2026-03-10

atapi.sys — Missing 0xFF floating-bus status check in AtapiNoDeviceConnected (CWE-755) fixed

KB5087545

KB published 2026-05-12

cldflt.sys — Negative file size / valid-data-length accepted in placeholder update path (CWE-1284) fixed

KB5078752

KB published 2026-03-10

cmimcext.sys — Out-of-bounds pool read via miscalculated ETW descriptor size (CWE-125) in CmCompleteInitMachineConfig fixed

KB5082123

KB published 2026-04-14

cng.sys — Defensive iteration caps on two ML-DSA rejection-sampling loops (SymCryptMlDsaRejBoundedPoly and SymCryptMlDsaRejNttPoly), CWE-835, low severity, fixed

KB5077179

KB published 2026-02-10

csc.sys — CSC reboot-rename registry keys could be created without an explicit owner security descriptor when a feature-staging gate was off (CWE-732), fixed

KB5075912

KB published 2026-02-10

csc.sys — CscDclMRxTransition LVIEW null check made unconditional, closing a possible NULL-pointer dereference (CWE-476) fixed

KB5078885

KB published 2026-03-10

ehstorclass.sys — Missing device-type check before installing IEEE 1667 silo completion routine (CWE-697/CWE-843) — fixed

KB5078752

KB published 2026-03-10

fvevol.sys — Datum type-field high bit not masked before presence/type checks (CWE-20) fixed

KB5094127

KB published 2026-06-09

hidbth.sys — Request-buffer and pending-count leak on a race-gated reconnect error path (CWE-401) fixed

KB5078752

KB published 2026-03-10

afd.sys — Feature-gated state guard blocks queuing accept/receive IRPs onto a cancelled AFD SAN endpoint (CWE-416) fixed

KB5078885

KB published 2026-03-10

agrsm64.sys — Modem driver disabled by DriverEntry kill-switch; unbounded IOCTL_SERIAL_SET_QUEUE_SIZE pool allocation (CWE-789) fixed

KB5078752

KB published 2026-03-10

appid.sys — Uninitialized paged pool memory in SmartlockerConstructOriginClaim (CWE-908) fixed

KB5094127

KB published 2026-06-09

cea.sys — Unnecessary caller process-handle exposure over broker RPC (CWE-668) fixed

KB5078752

KB published 2026-03-10

ci.dll — Defense-in-depth iteration caps in ML-DSA rejection samplers (CWE-835) fixed

KB5077179

KB published 2026-02-10

msseccore.sys — Uninitialized OSVERSIONINFOW zeroed before RtlGetVersion in DriverEntry (CWE-908), fixed

KB5073724

KB published 2026-01-13