This Metasploit module exploits a vulnerability in win32k.sys where under specific conditions TrackPopupMenuEx will pass a NULL pointer to the MNEndMenuState procedure. This Metasploit module has been tested successfully on Windows 7 SP0 and Windows 7 SP1.
181f4cfbdc09dfbd74b82a9c5495d3a4978f7ba84e532a43bc1638ebaee3ad62