Credit is to "Nils Sommer of bytegeist, working with Google Project Zero".
I confirm the apparent vulnerability on Win 7 32-bit, with special pool enabled. I run the .exe just once from the command prompt and immediately my VM dies, but in a strange way: it looks like it's about to do a blue screen and there is a video mode change but it hangs at a black screen.
Nils did get a debug dump, attached.
---
The attached testcase crashes Win 7 with Special Pool enabled while accessing the freed global cursor object (_gpqCursor). See poc.cpp for instructions on how to compile and run.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
---
