Async Windows Gone Wrong: Exploiting a Win32k Type Confusion Bug

Original text by s4dbrd

The article analyzes a Windows kernel vulnerability in win32kfull.sys involving a type confusion bug in the asynchronous window action processing path. The vulnerability occurs in logic responsible for handling window-related operations when certain internal features are enabled through Microsoft’s feature-flag system. Because of inconsistent object handling, the kernel may treat one…

https://core-jmp.org/2026/03/async-windows-gone-wrong-exploiting-a-win32k-type-confusion-bug/