Organizer
Partner Company
Revisiting Windows 11 KTM: Lessons Learnt from New Vulnerabilities
Jael Koh, Cedric Halbronn
Security Researcher
Abstract
The Windows Kernel Transaction Manager (KTM) and its attack surface have been around since Windows Vista but this driver remains an overlooked component in 2025.
This talk, presented jointly by Jael and Cedric, will showcase the journey uncovering vulnerabilities in KTM and their similarities.
Thanks to prior research by Cedric Halbronn and Aaron Adams into an in-the-wild KTM exploit, (CVE-2018-8611) most of KTM's internals had been well documented - except two objects.
After attending Cedric's "Windows Exploit Engineering Foundation" training, Jael Koh investigated these two objects. To his surprise, Jael ended up discovering and reporting two Use-After-Free vulnerabilities in KTM within a span of three weeks. Microsoft fixed both vulnerabilities in the October 2024 Patch Tuesday Update. (CVE-2024-43570 and CVE-2024-43535).
Mid 2025, new code changes happened in KTM and vulnerabilities like CVE-2025-53140 were patched by Microsoft but there is no public information yet.
Finally, we will evaluate how difficult (or easy?) it is to do variant analysis with recent LLM/AI tooling, hoping to find new vulnerabilities in KTM...
Speaker Info
Jael Koh (@_jaelkoh) is a Security Researcher. He specializes in reverse engineering and exploit development.
Cedric Halbronn (X:@saidelike and Mastodon:@saidelike) is a security researcher specialised in vulnerability research and exploit development with over 15+ years experience. He has targeted lots of different software and hardware: Android, iPhone, Windows, Linux, SOHO devices, HP iLO, etc. with a focus on reliability and usability in real world situations. He won Pwn2Own in 2021 and 2022. He has spoken at many security conferences (OffensiveCon, Hexacon, RECon, HITB). He is the founder of EZSecLab and the maintainer of the “Windows Kernel Exploitation: Becoming an Advanced Exploit Developer” training.