vulnerability-research
36 posts
DuckDB trusts persisted blocks attackers control
DuckDB runs in-process as a C++ library. Its immutability and checksum assumptions create a quiet memory-corruption surface that host EDR never sees.
ScStoragePathFromUrl overflows the stack on PROPFIND
CVE-2017-7269 turns an unpatched IIS 6.0 WebDAV server into pre-auth RCE. The exploit primitive, the telemetry blind spot, and the residual exposure.
Stop Killing Games guarantees unpatched network-reachable code
Stop Killing Games is preservation law, not a security control. Statute governs publishers; it never patches the memory-corruption bugs attackers exploit.
No mitigations, full code execution
Memory corruption in shared embedded firmware components grants attacker code execution at firmware privilege, replicated across hundreds of vendor devices.
NetScaler trusts snprintf, leaks adjacent heap memory
Why 'silent' vulnerabilities like Citrix Bleed (CVE-2023-4966) are already exploited at the network edge, what they produce in telemetry, and where defenders are blind.
Sixty-three days to patch a forked parser
Technical breakdown of the FrontierOS RCE: a forked XML parser, an unpatched two-year-old CVE, and the fork-tracking failure that shipped it.
Cypherpunk frees the key schedule twice
UAF in the Cypherpunk Library's context teardown - CWE-416, heap reuse, sandbox-free RCE path, and why EDR misses the corruption stage.
IOCCC 2025 ships glibc tcache poisoning primitives
The 29th IOCCC's 2025 winners distill heap metadata corruption, tcache poisoning, and type confusion into legal C - the same primitives behind modern CVEs.
Steam's I/O thread is holding a dead pointer
Transport-layer race condition in Valve's GameNetworkingSockets creates a remote UAF primitive that sits below session crypto and evades EDR telemetry.
The 64KB segment where every overflow rewrote a free list pointer
Win16's Local Heap overflow defines the metadata corruption class that still drives modern browser and kernel exploitation in 2026.
Korea's KCSC mandates server-side image parsers
Korea's mandatory AI image scanning forces every forum into a multi-layer parser and ML pipeline. The CVE surface and exploitation paths that result.
memcpy walks off the end of the receiver
rsync shipped six CVEs in January 2025. LLMs did not write new bugs - they compressed variant discovery, harness generation, and vulnerable deployment.