Security Research

Security Blog

Page 14

medium8 min

Unsafe Dict Merge in Scapy: How __dict__.update() Opens the Door to Object Injection

A medium-severity vulnerability was discovered and patched in `scapy/scapy_pcp.py`, where an unchecked `self.__dict__.update(entries)` call allowed attackers to inject arbitrary keys—including dangerous dunder attributes—directly into object namespaces via untrusted network packet data. Left unpatched, this flaw could enable object state corruption, method overwriting, and potential remote code execution in applications that parse attacker-controlled packets. The fix introduces proper key filter

#python#security#scapy+4 more
O
orbisai0security
May 14, 2026
critical9 min

Heap Buffer Overflow in HAL Filter: How Unvalidated memcpy Sizes Can Sink Your App

A critical heap buffer overflow vulnerability was discovered and patched in the ndsrvp HAL filter routines, where multiple `memcpy` calls used computed sizes derived from image dimensions without validating they fit within destination buffers. An attacker supplying a crafted image could exploit this to corrupt heap memory, potentially achieving arbitrary code execution. This post breaks down how the vulnerability works, how it was fixed, and what developers can do to prevent similar issues.

#buffer-overflow#memory-safety#cpp+4 more
O
orbisai0security
May 14, 2026
medium8 min

Fixing OS Command Injection in SageMath: Shell Metacharacter Attacks

A critical command injection vulnerability was discovered and patched in `drsolve_sage_interface.sage`, where unsanitized user-supplied polynomial expressions were passed directly to subprocess calls, potentially allowing attackers to execute arbitrary OS commands. This fix closes a dangerous attack vector that could have granted full system access to anyone able to submit crafted mathematical input. Understanding how this class of vulnerability works—and how to prevent it—is essential for any d

#security#command-injection#python+4 more
O
orbisai0security
May 14, 2026
medium8 min

Command Injection in Firejail's netfilter.c: How Environment Variables Can Lead to Root Compromise

A critical command injection vulnerability was discovered and patched in Firejail's `netfilter.c`, where attacker-controlled environment variables could be used to inject shell metacharacters into a command string executed with elevated privileges. This type of vulnerability is particularly dangerous in security-focused tools like Firejail, which often run with root or elevated permissions, potentially allowing a local attacker to achieve full system compromise. The fix removes the unsafe `exec(

#command-injection#firejail#linux-security+4 more
O
orbisai0security
May 13, 2026
critical8 min

Stack Buffer Overflow in MapScale: How Five Unsafe sprintf Calls Created a Critical Vulnerability

A critical stack-based buffer overflow vulnerability was discovered and patched in `src/mapscale.c`, where five unbounded `sprintf` calls wrote formatted output into fixed-size stack buffers without any bounds checking. An attacker controlling unit text strings could overflow the stack buffer, potentially overwriting the function return address and achieving arbitrary code execution. The fix replaces dangerous `sprintf` calls with their bounds-checked counterparts, eliminating the overflow risk

#buffer-overflow#c-security#CWE-120+4 more
O
orbisai0security
May 13, 2026
medium10 min

Integer Overflow to Heap Corruption: Fixing a Critical q3asm Vulnerability

A critical integer overflow vulnerability in the Quake 3 assembler tool (q3asm) allowed attackers to craft malicious assembly source files that triggered heap corruption through a size calculation wraparound, potentially enabling function pointer hijacking and full supply-chain compromise in CI/CD pipelines. The fix introduces proper bounds checking and overflow-safe allocation size calculations, closing a dangerous attack vector that could have given adversaries elevated pipeline privileges. Th

#integer-overflow#heap-corruption#supply-chain-security+4 more
O
orbisai0security
May 13, 2026
critical8 min

Heap Buffer Overflows in YAML Parser: How Unchecked memcpy Calls Create Critical Attack Vectors

A critical heap buffer overflow vulnerability was discovered and patched in the YAML parser embedded within an Android VPN application, where five unvalidated `memcpy` calls could allow an attacker to corrupt heap memory by supplying a crafted YAML configuration file. This class of vulnerability is particularly dangerous because it can lead to arbitrary code execution or application crashes in security-sensitive contexts. The fix adds proper bounds validation before each copy operation, eliminat

#buffer-overflow#c-security#yaml-parser+4 more
O
orbisai0security
May 13, 2026
critical8 min

Critical Buffer Overflow Fixed: When "Safe" Functions Aren't Safe

A critical vulnerability in DeepSkyStackerKernel's StackWalker.cpp was silently replacing bounds-checking string functions with their unsafe counterparts via preprocessor macros, exposing the entire codebase to buffer overflow attacks. This fix removes the dangerous macro definitions that discarded buffer size arguments, restoring the intended memory safety protections across all call sites. Understanding how this subtle macro trick works is essential for any C/C++ developer working with string

#buffer-overflow#c-cpp#security+4 more
O
orbisai0security
May 13, 2026
critical8 min

Heap Buffer Overflow in Lexer: How a Missing Bounds Check Becomes Critical

A critical heap buffer overflow vulnerability was discovered and patched in a C lexer implementation, where accumulated line data could silently overwrite adjacent heap memory due to a missing bounds check before a memcpy operation. This class of vulnerability can lead to arbitrary code execution, data corruption, or application crashes, making it one of the most dangerous bugs a C developer can encounter. The fix reinforces why defensive buffer management is non-negotiable in systems-level code

#c#buffer-overflow#heap-overflow+4 more
O
orbisai0security
May 13, 2026
critical7 min

Path Traversal Vulnerability Fixed in Hatch-Pet Scripts: A Deep Dive

A high-severity path traversal vulnerability was discovered and patched in the hatch-pet script suite, where unsanitized user input could allow attackers to read or overwrite sensitive files anywhere on the filesystem. The fix ensures that file paths are properly validated before use, preventing attackers from escaping the intended working directory. Understanding this class of vulnerability is essential for any developer working with file I/O and user-supplied input.

#security#path-traversal#python+4 more
O
orbisai0security
May 13, 2026
critical8 min

Stack Buffer Overflow via Unbounded sprintf() in HardInfo2 CPU Utility

A critical stack buffer overflow vulnerability was discovered and patched in HardInfo2's cpu_util.c, where six unbounded sprintf() calls wrote locale-translated CPU topology labels into fixed-size stack buffers without length constraints. An attacker supplying a crafted translation file could overflow the stack buffer, overwrite saved return addresses, and potentially achieve arbitrary code execution. The fix replaces these dangerous calls with length-bounded alternatives, eliminating the overfl

#buffer-overflow#c-security#sprintf+4 more
O
orbisai0security
May 13, 2026
critical8 min

Critical Buffer Overflow in plugin.c: How Unsafe sprintf() Calls Enable Code Execution

A critical buffer overflow vulnerability was discovered and patched in plugin.c, where five unbounded sprintf() calls wrote into fixed-size buffers without validating input length. An attacker controlling NVMe device names or plugin metadata could exploit this to overwrite return addresses and achieve arbitrary code execution. The fix eliminates these unsafe calls, closing a classic but devastatingly effective attack vector.

#buffer-overflow#C#security+4 more
O
orbisai0security
May 13, 2026