Rick Larabee

The cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialize PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend, such as the file system or the `sys registry` database table, can inject a crafted serialized payload to trigger PHP Object Injection. This may allow the exploitation of a gadget chain to achieve Remote Code Execution.

A double free vulnerability in the Ancillary Function Driver (AFD) in afd.sys allows local users to gain privileges via a crafted application. This vulnerability could allow elevation of privilege, enabling an attacker to execute arbitrary code and take complete control of an affected system. The attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.