The escape handler for 0x10000e9 lacks bounds checks, and passes a user specified size as the size to memcpy, resulting in a stack buffer overflow.

There is a missing bounds check in inner loop of the escape handler for 0x7000014 that leads to a stack buffer overflow.

Gentoo Linux Security Advisory 201610-9 – Multiple vulnerabilities have been found in the Chromium web browser, the worst of which allows remote attackers to execute arbitrary code. Versions less than 54.0.2840.59 are affected.

The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks.

The DxgkDdiEscape handler for 0x7000170 lacks proper bounds checks for the variable size input escape data, and relies on a user provided size as the upper bound for writing output.

The DxgkDdiEscape handler for escape 0x100009a lacks proper bounds checks.