Diff work corpus browser

The Drift Corpus: Ring 0

An open-source corpus of Windows kernel patch diffs — every Microsoft-patched vulnerability reverse-engineered into per-function assembly diffs, root-cause analysis, and reproduction aids.

All posts

2026-06-09 CorpusCritical

http.sys — Integer overflow in per-request array capacity (CWE-190) causing kernel pool overflow in UlpParseNextRequest fixed

KB5094127
KB published 2026-06-09

Argus
2026-06-09 CorpusCritical

tcpip.sys — FseProcessIncomingMessages Kernel Pool Out-of-Bounds Write in FSE Message Reassembly

KB5094126
KB published 2026-06-09

Argus
2026-04-14 CorpusCritical

cea.sys — Integer overflow (CWE-190) leading to kernel pool buffer overflow (CWE-122) in EaSignalAggregatedEvent fixed

KB5082142
KB published 2026-04-14

Argus
2026-01-13 CorpusCritical

dxgkrnl.sys — Use-After-Free (CWE-416) — missing reference count on DXGSHAREDVMOBJECT in DXG_HOST_REMOTEOBJECTCHANNEL::ProcessChannelMessage fixed

KB5073724
KB published 2026-01-13

Argus
2026-01-13 CorpusCritical

fcvsc.sys — untrusted host transaction ID dereferenced as kernel SRB pointer (CWE-822) fixed

KB5073723
KB published 2026-01-13

Argus
2026-06-23 CorpusHigh

tcpip.sys — UdpConnectRedirect Stack Use-After-Return via Asynchronous WFP ALE Connect-Redirect

KB5095091
KB published 2026-06-23

Argus
2026-06-09 CorpusHigh

afd.sys — Integer underflow in accept options copy leading to kernel pool buffer overflow (CWE-191) fixed

KB5094122
KB published 2026-06-09

Argus
2026-06-09 CorpusHigh

afd.sys — SAN/Winsock-Direct accept path: 16-bit integer-underflow OOB-write fix is STAGED behind a feature flag (not delivered); the delivered changes are a SAN accept cancellation-race/UAF hardening and transport-open access-control scoping

KB5094123
KB published 2026-06-09

Argus
2026-06-09 CorpusHigh

cea.sys — integer overflow leading to pool buffer overflow in EaSignalAggregatedEvent (CWE-190) fixed

KB5094128
KB published 2026-06-09

Argus
2026-06-09 CorpusHigh

disk.sys — Out-of-bounds read (CWE-125) and out-of-bounds write (CWE-787) in SCSI mode page parsing fixed

KB5094128
KB published 2026-06-09

Argus
2026-06-09 CorpusHigh

tcpip.sys — Out-of-bounds pool write in FseProcessIncomingMessages (unbounded length-prefixed reassembly into a fixed 0x400 buffer)

KB5093998
KB published 2026-06-09

Argus
2026-06-09 CorpusHigh

vmstorfl.sys — Guest-triggerable OOB write in Hyper-V host SCSI sense-data translation (missing SRB offset/length validation)

KB5094128
KB published 2026-06-09

Argus
2026-05-12 CorpusHigh

afd.sys — Out-of-bounds write (CWE-787) in SAN accept address handling and out-of-bounds read (CWE-125) in super-accept address retrieval fixed

KB5087537
KB published 2026-05-12

Argus
2026-05-12 CorpusHigh

http.sys — TOCTOU double-fetch leading to kernel memory disclosure (CWE-367, CWE-200) in UlGenerateTrailers fixed

KB5087420
KB published 2026-05-12

Argus
2026-04-14 CorpusHigh

afd.sys — Out-of-bounds write via missing 10-byte header reservation (CWE-787) in AfdRestartSuperAcceptGetAddress fixed

KB5082123
KB published 2026-04-14

Argus
2026-03-10 CorpusHigh

csvflt.sys — Race Condition (CWE-362) leading to Use-After-Free (CWE-416) in CsvCamSetSecurityInfo fixed

KB5078752
KB published 2026-03-10

Argus
2026-03-10 CorpusHigh

csvfs.sys — TOCTOU Race Condition / Use-After-Free (CWE-362, CWE-416) in CsvCamSetSecurityInfo fixed

KB5078752
KB published 2026-03-10

Argus
2026-03-10 CorpusHigh

csvnsflt.sys — Use-After-Free race from unlocked global reads in CsvCamSetSecurityInfo (CWE-416, CWE-362) fixed

KB5078752
KB published 2026-03-10

Argus
2026-03-10 CorpusHigh

dxgkrnl.sys — Race condition (insufficient lock strength) leading to double-free / use-after-free in DXGSWAPCHAIN swapchain sync-object teardown (CWE-362) fixed

KB5078885
KB published 2026-03-10

Argus
2026-02-10 CorpusHigh

afd.sys — missing output-buffer bounds check on accepted-connection transport-address copy in AfdSanAcceptCore (CWE-120) fixed

KB5075912
KB published 2026-02-10

Argus
2026-02-10 CorpusHigh

http.sys — Double-fetch / TOCTOU on user-supplied trailer source pointer (CWE-367) in UlGenerateTrailers fixed

KB5077181
KB published 2026-02-10

Argus
2026-01-13 CorpusHigh

afd.sys — Out-of-bounds read/write via feature-gated length clamp in AfdRestartSuperAcceptGetAddress (CWE-787) fixed

KB5073722
KB published 2026-01-13

Argus
2026-01-13 CorpusHigh

ccffilter.sys — Out-of-bounds read due to inverted bounds check (CWE-125, CWE-697) in CCFFilterAppInstanceEA fixed

KB5073723
KB published 2026-01-13

Argus
2026-01-13 CorpusHigh

cdfs.sys — integer overflow leading to kernel pool buffer overflow (CWE-190, CWE-122) in CdAddAllocationFromDirent fixed

KB5073723
KB published 2026-01-13

Argus
2026-01-13 CorpusHigh

csvvbus.sys — Use-after-free from unsynchronized EncryptionManager access (CWE-416) fixed

KB5073723
KB published 2026-01-13

Argus
2026-01-13 CorpusHigh

http.sys — Out-of-bounds access via missing QPACK ordinal validation (CWE-787, CWE-125) in QkIsOrdinalUseable fixed

KB5074109
KB published 2026-01-13

Argus
2026-06-09 CorpusMedium

ci.dll — Security-relevant change: custom-kernel-signer trust-decision hardening (CWE-863), plus SymCrypt ML-DSA termination hardening

KB5095051
KB published 2026-06-09

Argus
2026-06-09 CorpusMedium

cldflt.sys — Missing sign/bounds/overflow validation of file-range values on cloud-files control paths (CWE-20) made unconditional; fixed

KB5094127
KB published 2026-06-09

Argus
2026-06-09 CorpusMedium

dxgmms2.sys — Use-After-Free (CWE-416) in VidSchiAddPendingCommandToSyncPointList fixed

KB5094127
KB published 2026-06-09

Argus
2026-06-09 CorpusMedium

exfat.sys — Improper input validation of negative file size/offset in IRP_MJ_SET_INFORMATION handlers (CWE-20) fixed

KB5094127
KB published 2026-06-09

Argus
2026-06-09 CorpusMedium

http.sys — Feature-gated HTTP header-count resource limit (CWE-400) and 16-bit buffer-growth integer-overflow guard (CWE-190), fixed

KB5093998
KB published 2026-06-09

Argus
2026-06-09 CorpusMedium

hvsocket.sys — One delivered security fix: an unconditional connection-establishment race hardening (CWE-362) in the AF_HYPERV connect() path (VmbusTlProviderConnect); the originally-claimed socket-address/authorization bypass remains a false positive (validation identical in both builds)

KB5094128
KB published 2026-06-09

Argus
2026-06-09 CorpusMedium

ksecdd.sys — NULL-pointer dereference & missing ProbeForRead in SSPI dispatch and IOCTL paths (CWE-476, CWE-822) fixed

KB5094128
KB published 2026-06-09

Argus
2026-06-09 CorpusMedium

ksecpkg.sys — Missing minimum-length validation before TLS/DTLS record header reads (CWE-125) fixed

KB5094128
KB published 2026-06-09

Argus
2026-06-09 CorpusMedium

mrxsmb.sys — Read-after-free of VNetRoot device-object pointer in tree-connect completion (CWE-416) fixed

KB5094127
KB published 2026-06-09

Argus
2026-06-09 CorpusMedium

vhdmp.sys — Kernel-pointer information disclosure in the dependent-disk / STORAGE_DEPENDENCY_INFO query handler (sub_1C008F040)

KB5094127
KB published 2026-06-09

Argus
2026-06-09 CorpusMedium

vhdmp.sys — Kernel-pointer information disclosure in the storage-dependency query handler (sub_1C0082CCC)

KB5094123
KB published 2026-06-09

Argus
2026-06-09 CorpusMedium

winhv.sys — Missing Active-Processor Bound in VTL Per-VP Hypercall Path

KB5094128
KB published 2026-06-09

Argus
2026-05-12 CorpusMedium

afd.sys — Use-after-free hardening via reference-count integrity fastfail checks (CWE-416) fixed

KB5087545
KB published 2026-05-12

Argus
2026-05-12 CorpusMedium

hvsocket.sys — Use-after-free / race on loopback socket endpoint access (CWE-416 / CWE-362) fixed by removing a feature gate and making reference-counted endpoint access unconditional

KB5087538
KB published 2026-05-12

Argus
2026-05-12 CorpusMedium

mrxsmb.sys — Use-after-free read of VNetRoot context in tree-connect completion (CWE-416), mitigated behind a feature flag

KB5089549
KB published 2026-05-12

Argus
2026-05-12 CorpusMedium

mrxsmb.sys — Use-after-free read of VNetRoot context in tree-connect completion (CWE-416), mitigated behind a feature flag

KB5089549
KB published 2026-05-12

Argus
2026-05-12 CorpusMedium

ntfs.sys — $LogFile restart-table validation and integer-overflow checks made unconditional (CWE-20, CWE-190) — feature gate removed, fixed

KB5087538
KB published 2026-05-12

Argus
2026-05-12 CorpusMedium

pci.sys — Missing MSI-X capability validation and dangling IO-mapping pointer causing double MmUnmapIoSpace (CWE-20, CWE-825) fixed

KB5087545
KB published 2026-05-12

Argus
2026-04-14 CorpusMedium

afd.sys — Race condition on endpoint dispatch-pointer swap in AfdTLListenComplete (CWE-362) fixed

KB5082198
KB published 2026-04-14

Argus
2026-04-14 CorpusMedium

ataport.sys — Use-after-free fix in `IdePortTickHandler`: periodic tick now holds the device remove lock (plus an unrelated ATA error-retry refactor)

KB5082142
KB published 2026-04-14

Argus
2026-04-14 CorpusMedium

ci.dll — Unchecked return value in ML-DSA secret-vector expansion (CWE-252/CWE-754) fixed

KB5083768
KB published 2026-04-14

Argus
2026-04-14 CorpusMedium

hvsocket.sys — VMBus loopback endpoint spinlock conditionally skipped behind a feature gate, allowing an unsynchronized access race (CWE-362) — fixed by making locking unconditional

KB5082123
KB published 2026-04-14

Argus
2026-04-14 CorpusMedium

ntfs.sys — Feature-gated bounds/size validation in $LogFile restart-table recovery made unconditional (CWE-787) — fixed

KB5082123
KB published 2026-04-14

Argus
2026-03-10 CorpusMedium

afd.sys — Pending IRPs left queued on a recycled connection during AFD SAN teardown (CWE-416) fixed

KB5078752
KB published 2026-03-10

Argus