## https://sploitus.com/exploit?id=CD74BF15-81FC-5A29-8E61-DAF091D0A1CF
# CVE-2026-62737 — ExecutionContext.sys Arbitrary Kernel Call
Proof of concept for CVE-2026-62737: `ExecutionContext.sys` invokes a
user-controlled `TaskFn` pointer in kernel mode without validation, producing a
controlled kernel crash.
Validated on stock Windows 11 25H2 (build 26200.8655, ARM64): `0x7E
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED`, with the faulting RIP set to the PoC's
controlled `TaskFn` marker.
The same script did not crash an unmodified Windows 11 24H2 system (build
26100.5074, x64) because Windows kept the vulnerable kernel path disabled behind
an internal feature flag. In a separate lab-only test, we manually changed that
flag in live kernel memory and then observed a `0x50` crash. Because that test
modified the running kernel, it is not a stock 24H2 reproduction. The clean
stock reproduction is the Windows 11 25H2 ARM64 result above.
This PoC demonstrates the arbitrary kernel-call primitive and a kernel DoS; it
does not implement a complete token-stealing LPE.
## Usage
Run the script from the directory containing it. On the tested Windows 11 25H2
VM, the shared-folder copy ran under the normal PowerShell execution policy;
`ExecutionPolicy Bypass` was not required.
```powershell
# Probe the device without triggering the bugcheck
.\ecpoc-route-b.ps1 -ProbeOnly
# Trigger the bugcheck (crashes the machine)
.\ecpoc-route-b.ps1
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\ecpoc-route-b.ps1
```
Self-contained PowerShell script using C# `Add-Type`; supports x64 and ARM64.