tag
Aslr-Bypass
nginx PCRE Capture Variable Heap Overflow to Pre-Auth RCE (CVE-2026-42533)
CVE-2026-42533 is a heap buffer overflow in nginx triggered by PCRE regex capture variable handling. When two map directives share the same capture group name, a length/value mismatch occurs in the internal variable copy code (ngxhttpscriptcopycapturecode and…
MariaDB — Low-Privilege Remote Code Execution via ST_Area OOB Read + SYS_REFCURSOR Use-After-Free
This PoC chains two MariaDB memory-safety bugs to achieve remote code execution as the mariadbd process from a low-privilege database account — no special grants, no filesystem access, no administrative role:
GitLab Notebook-Diff Oj Parser Memory-Corruption Chain → Unauthenticated-Reach RCE (No CVE Yet)
GitLab renders diffs for Jupyter notebooks by passing repository-controlled JSON through Oj, a native (C-extension) Ruby JSON parser, in the Puma worker process. The researcher (Yuhang Wu, depthfirst.com) found and chained two distinct memory-corruption bugs…
PostgreSQL pgcrypto PGP Heap Overflow to Superuser Escalation — CVE-2026-2005
The pgcrypto extension's PGP session-key parsing contains a heap-based buffer overflow that corrupts MBuf structure headers used internally to track ciphertext/plaintext buffers. By crafting malicious PGP messages passed to pgcrypto decryption functions, a…
nginx PoolSlip × Rift Chained ASLR-Independent Remote Code Execution (CVE-2026-9256 / CVE-2026-42945)
This PoC chains two nginx rewrite-engine bugs that share the same root cause — a two-pass mismatch in how isargs/$args length is computed — into a single ASLR-independent remote system() call on a stock, unmodified nginx:1.30.0 Docker image, with no hardcoded…
objdump DLX ELF Backend Out-of-Bounds Write (Crash-to-Calc)
objdump -g (debug-info dumping) against a crafted ELF/DLX object file triggers an out-of-bounds write in the DLX ELF backend's relocation-processing code, writing outside the intended debug section buffer. The researcher shapes the crafted relocation data so…