Zero-day discoveries, responsible disclosure, and reproducible technical analysis. Every record links directly to the public evidence.
3 credited discoveriesPublic upstream advisories · Memory safety · Trust boundaries
CVE-2026-81494
From project-boundary escape to root command execution
A critical trust-boundary vulnerability chained with arbitrary host-file overwrite to demonstrate root command execution.
Zero-day discovery and responsible disclosure, with public reporter credit in the upstream advisory.
CVE-2026-68546
Heap out-of-bounds write
C++ memory-safety flaw in RemoteIo processing of URL-based resources.
CWE-787 in RemoteIo::Impl::populateBlocks(). Zero-day discovery and responsible disclosure, with public reporter credit.
CVE-2026-84448
Heap out-of-bounds read
Insufficient validation in inline-mask region handling, reproduced with AddressSanitizer.
A mismatch between caller-supplied mask length and region geometry. Zero-day discovery and responsible disclosure, with public reporter credit.
Existing vulnerabilities rebuilt in controlled labs; not presented as zero-day discoveries.
CVE-2024-36039
Object-key serialization leading to SQL injection
A Docker-based lab, reproducible proof of concept, and technical analysis of an existing vulnerability.
This is a reproduction and analysis of an existing vulnerability, separate from the zero-day discoveries. The lab demonstrates SQL injection through an object-key serialization flaw.