"Windows Dirty Pipe." An integer-overflow-to-out-of-bounds-write in the Named Pipe File System driver (npfs.sys), reachable only from an AppContainer or restricted (sandboxed) token - making it a renderer/UWP sandbox-escape rather than an ordinary local EoP (it was used at TianfuCup 2021 to escape the Adobe Reader sandbox). Opening \Device\NamedPipe\LOCAL\<name> reaches NpTranslateContainerLocalAlias, which rewrites the name into the AppContainer object namespace and sizes a pool buffer using 16-bit (ushort) arithmetic. A sufficiently long pipe name wraps the size to 0 (yielding a tiny 0x20 allocation) while the UNICODE_STRING MaximumLength, decremented past 0, underflows to 0xFFFE; RtlUnicodeStringPrintf then writes ~64 KB of attacker-controlled name into the tiny buffer - a controlled paged-pool overflow that can be groomed (WNF + _TOKEN objects) into arbitrary kernel read/write and SYSTEM. Microsoft's February 2022 fix widens the size arithmetic to 32-bit and adds a bound check (allocate only when the length is < 0xFFFF); the fix is unconditional (no feature flag). Reported by k0shl of Kunlun Lab. Confirmed by an in-house binary diff of npfs.sys 10.0.18362.267 -> .2094.

"Windows Dirty Pipe": a 16-bit integer overflow -> pool out-of-bounds write in npfs.sys NpTranslateContainerLocalAlias, reachable ONLY from an AppContainer/restricted (sandboxed) token - a renderer/UWP sandbox escape (used at TianfuCup 2021 to escape the Adobe Reader sandbox). Opening \Device\NamedPipe\LOCAL\<name> routes NpFsdCreate -> NpTranslateAlias (matches the LOCAL\ prefix) -> NpTranslateContainerLocalAlias, which rewrites the name into Sessions\<n>\AppContainerNamedObjects\<sid>\...\<name>. All size vars were 16-bit: total = prefix + namelen + 0x14 (+2 if the remaining name starts with '\'); a long pipe name wraps this ushort to 0, so ExAllocatePoolWithTag returns a tiny 0x20 'NpFn' buffer, and the UNICODE_STRING MaximumLength decremented past 0 underflows to 0xFFFE. RtlUnicodeStringPrintf then writes ~64KB of attacker-controlled name bytes into the 0x20 pool -> controlled paged-pool OOB write (CWE-190 -> CWE-787). The trigger needs the total size to wrap to exactly 0. IN-HOUSE ghidriff diff of 10.0.18362.267 -> .2094 confirms NpTranslateContainerLocalAlias is the ONLY changed function (99.8% match): the fix widens the size arithmetic from short to 32-bit int/uint (iVar5/iVar10/uVar6) and adds a bound check `if (uVar6 < 0xffff)` before ExAllocatePoolWithTag, eliminating both the overflow and the 0xFFFE underflow. UNCONDITIONAL fix - no CFR/KIR flag. k0shl's PoC chains WNF _WNF_STATE_DATA + _TOKEN grooming into arbitrary R/W and sets ETHREAD.PreviousMode=0. Credit: k0shl of Kunlun Lab via TianfuCup 2021.

A long LOCAL\ pipe name wraps a 16-bit size to 0 (tiny pool) while MaximumLength underflows to 0xFFFE, so the name format-copy overruns paged pool - from inside a sandbox

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Kunlun lab (https://www.cyberkl.com) via TianfuCup (https://www.tianfucup.com)