Tags
How an out-of-bounds read in MariaDB's .frm metadata parser can be turned into a forged C++ object with a fake vtable, reaching arbitrary code execution as the mariadbd process (MDEV-40571).
Read full articleWhen started with --reranking, llama.cpp lets a remote attacker trigger a denial of service (std::bad_alloc, HTTP 500) via a negative top_n on POST /rerank (CVE-2026-52132).
Read full articleA crafted GGUF file with an empty metadata key reaches an assertion in llama.cpp's gguf_reader::read and aborts the process. Affects any binary that loads GGUF files (CVE-2026-52131).
Read full articleA deeply nested JSON schema exhausts the recursion stack in llama.cpp's grammar converter, crashing the server. Only POST /completions is affected (CVE-2026-52130).
Read full articleAnalysis of a type confusion vulnerability caused by a missing global-property Map stability check in V8's TurboFan JIT, plus a Windows RCE exploit
Read full articleAnalysis of CVE-2021-26411, a UAF vulnerability in the Internet Explorer JavaScript engine that the Lazarus Group exploited in real-world attacks
Read full articleAn in-depth analysis of two vulnerabilities found in Netis MEX605 router firmware v2.00.06: OS command injection via the ping diagnostic tool, and DOM-based XSS in the NTP server configuration.
Read full articleAnalysis of an Integer Overflow (SMBGhost) and an uninitialized kernel memory leak (SMBleed) in the SMBv3.1.1 decompression routine, and a Pre-Auth RCE achieved by chaining the two bugs
Read full articleMounting a crafted f2fs image and running operations triggers a slab out-of-bounds read in ttm_put_pages.
Read full articleMounting a crafted btrfs image and running operations triggers a slab out-of-bounds write in __btrfs_map_block.
Read full articleMounting a crafted f2fs image triggers a NULL pointer dereference in f2fs_recover_fsync_data.
Read full articleMounting a crafted f2fs image triggers a slab out-of-bounds write in __remove_dirty_segment.
Read full articleA syncfs syscall after operations on a crafted btrfs image triggers a use-after-free reached via mutex_can_spin_on_owner.
Read full articleMounting a crafted f2fs image triggers a slab out-of-bounds read in init_min_max_mtime.
Read full articleA syncfs syscall after operations on a crafted btrfs image triggers a use-after-free in try_merge_free_space.
Read full articleMounting a crafted ext4 image, running a few operations, then unmounting triggers a use-after-free in ext4_put_super.
Read full articleMounting a crafted btrfs filesystem image leads to a slab-out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c.
Read full articleMounting a crafted btrfs image, performing some operations, and unmounting leads to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.
Read full articleMounting a crafted btrfs image twice causes an rwsem_down_write_slowpath use-after-free because rwsem_owner_flags returns an already freed task_struct pointer.
Read full articleA setxattr operation after mounting a crafted ext4 image causes a slab-out-of-bounds write in ext4_xattr_set_entry because a large old_size value is used in a memset call.
Read full article__btrfs_free_extent in fs/btrfs/extent-tree.c calls btrfs_print_leaf in a certain ENOENT case, leaking potentially sensitive register values to local users through dmesg.
Read full articleext4_empty_dir in fs/ext4/namei.c allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can return zero after a crafted ext4 image is mounted.
Read full articlebtrfs_root_node in fs/btrfs/ctree.c allows a NULL pointer dereference because rcu_dereference(root->node) can return zero when a crafted btrfs image is mounted.
Read full articleA crafted btrfs image triggers a NULL pointer dereference in btrfs_verify_dev_extents because fs_devices->devices is mishandled inside find_device (fs/btrfs/volumes.c) in Linux kernels before 5.1.
Read full articleA retrospective on my time in Best of the Best (BoB) Cohort 8 — building a filesystem fuzzer, finding 16 CVEs, and speaking at CodeBlue and HITB
Read full articleAnalysis of a heap-based buffer overflow in FFmpeg's libavformat HLS demuxer — arbitrary code execution via a crafted HLS playlist
Read full article