This is a working exploit for a vulnerability in win32kfull!WindowActions::xxxInterceptSetWindowPos on Windows 11. The vulnerability has been fixed as of the May 2026 security update. I don't know which CVE it is since I didn't report it to Microsoft. I wanted to participate in Pwn2Own 2026 with this one but it got patched.

The exploit should work out of the box for all release versions of Windows 24H2 and 25H2 up to the May 2026 security patch. For insider versions later than Apr 26, you'll need to define HAS_TOKEN_CHANGE_PATCH to 1. It's not a very nice exploit in that it takes up to 1 minute to execute at times and that it can allocate up to 4GB of RAM. However, it should work pretty reliably on stock versions. It's possible that it causes a crash here and there, but it shouldn't happen too often. Also, it's going to work pretty nicely the first time you run it but may be harder to get working if you need to try to run it multiple times in the same session.

I'm not going to publish a write-up and the code has deliberately been stripped of comments and print statements, but if you're trying to understand what's happening and get stuck along the way, feel free to DM me on mastodon or send an e-mail.