Win32k Smash the Ref: New Bug Class and Exploitation Techniques [pdf] | Hacker News Reader