The escape handler for 0x10000e9 lacks bounds checks, and passes a user specified size as the size to memcpy, resulting in a stack buffer overflow.
e764018c50128a89c728c3202c374cd2eee6b13beea7305fa6c32f6c0bab6212
© 2022 Packet Storm. All rights reserved.