HEVD: FROM STACK OVERFLOWS TO MODERN POOL GROOMING

Summary from the TLDR InfoSec newsletter

This four-part series traced the arc of Windows kernel exploitation on a deliberately vulnerable driver, moving from classic stack corruption and SMEP-bypassing ROP chains through arbitrary-write primitives into pure Data-Only attacks. The later stages reflected how modern Windows 11 mitigations, which strip kernel pointer leaks and harden execution hijacking, have pushed offensive research toward kernel pool grooming and named-pipe-based heap manipulation instead. The progression illustrated a broader industry shift: privilege escalation research increasingly abandons control-flow hijacking in favor of data-only techniques that sidestep control-flow integrity protections entirely.