nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers between user and kernel mode is mishandled.
No PoCs from references.
- https://github.com/DownWithUp/CVE-Stockpile