Microsoft Windows CreateWindow Function Callback Exploit (MS10-032)

When the "CreateWindow" function is called, the Windows kernel calls to user through callbacks pushing in the stack many arguments to be used for the callback function. One argument of these is the hParent Window. After that, the windows kernel re-uses this argument. If this argument is modified by the callback function, the bug is triggered.
Exploit Platform
Product Name