Windows exposes a large attack surface through COM and RPC services, where low-privileged clients can interact with highly privileged system components. While these IPC mechanisms provide structured communication and type safety, the security of the system ultimately depends on the correctness of the underlying service implementations. Even when the IPC layer correctly validates and marshals data, vulnerabilities can still arise from flawed assumptions made by privileged services when processing external inputs and managing internal state.
In this talk, I present several vulnerabilities I discovered in Windows COM/RPC services, including out-of-bounds accesses, type confusion, double frees, race conditions, and use-after-free issues. These flaws show how implementation mistakes inside privileged services can turn seemingly safe IPC interfaces into privilege escalation attack surfaces. I will discuss how these vulnerabilities were uncovered through reverse engineering, interface reconstruction, and analysis of object lifetimes, synchronization mechanisms, and memory management within Windows components.
