CVEs-PoC/2016/CVE-2016-2336.md

### [CVE-2016-2336](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2336)
![](https://img.shields.io/static/v1?label=Product&message=Ruby&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.2.2%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=2.3.0%20dev%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=type%20confusion&color=brightgreen)

### Description

Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed by developers can cause arbitrary code execution.

### POC

#### Reference
- http://www.talosintelligence.com/reports/TALOS-2016-0029/

#### Github
No PoCs found on GitHub currently.