Security Research

Security Blog

Page 3

critical7 min

Shell Injection via os.system(): How a Single Line of Code Can Compromise Your System

A critical OS command injection vulnerability (CWE-78) was discovered and patched in `voice.py`, where user-controlled input was interpolated directly into a shell command string passed to `os.system()`. An attacker who could influence the `device` variable — through a config file, environment variable, or any external input — could execute arbitrary system commands with the full privileges of the running process. The fix replaces the dangerous `os.system()` calls with Python's `subprocess.run()

#security#python#command-injection+4 more
O
orbisai0security
May 28, 2026
critical9 min

Critical Buffer Overflow in VMS Mail: How strcpy() Became a Security Nightmare

A critical buffer overflow vulnerability was discovered and patched in `sys/vms/vmsmail.c`, where eight unchecked calls to `strcpy()` and `strcat()` allowed externally-sourced mail message content to overflow fixed-size buffers. An attacker capable of sending a crafted VMS mail message could overwrite stack return addresses, potentially achieving arbitrary code execution. The fix replaces all dangerous string operations with bounds-checked `snprintf()` calls, eliminating the overflow risk entire

#buffer-overflow#c-security#strcpy+4 more
O
orbisai0security
May 28, 2026
critical7 min

Critical Buffer Overflow in RC Device Parser: How One Missing Bounds Check Opens the Door to Memory Corruption

A critical buffer overflow vulnerability was discovered in the RC device request parser (`rcdevice.c`), where incoming packet data was written to a fixed-size buffer using an attacker-controlled length field as the only guard. Because the expected data length was parsed directly from the packet without being validated against the actual allocated buffer size, a malicious packet could overflow the buffer and overwrite adjacent stack or heap memory with arbitrary bytes. The fix adds a single, esse

#buffer-overflow#embedded-security#c-programming+4 more
O
orbisai0security
May 28, 2026
high7 min

Buffer Overflow in RS-232 Serial Input: How a Missing Length Check Put Embedded Systems at Risk

A critical buffer overflow vulnerability was discovered in `serial.c`, where the `rs232_buffered_input` function could write more bytes than the destination buffer `rs232_ibuff` could hold — with no size limit to stop it. An attacker with access to the RS-232 serial port could exploit this to overwrite adjacent OS memory, including return addresses and critical data structures. The fix adds a simple but essential bounds check that clamps the returned byte count to the actual buffer size.

#buffer-overflow#embedded-security#c-programming+4 more
O
orbisai0security
May 28, 2026
critical7 min

Critical Buffer Overflow Fix: How Unbounded strcpy() Puts Your System at Risk

A critical buffer overflow vulnerability was discovered in a custom `strcpy()` implementation that performed unbounded memory copies without any destination buffer size validation. In kernel and OS contexts, this flaw could allow attackers to overwrite return addresses, corrupt heap metadata, or destabilize critical system data structures. The fix replaces the unsafe `strcpy()` with a bounds-checked `strlcpy()` that enforces a maximum copy length, eliminating the overflow risk entirely.

#buffer-overflow#c-security#memory-safety+4 more
O
orbisai0security
May 28, 2026
critical7 min

Critical Buffer Overflow Fixed: memcpy Without Bounds Checking in C++ Integer Wrapper

A critical buffer overflow vulnerability was discovered and patched in `libs/intx/wrapper.cpp`, where `memcpy` operations wrote into fixed-size buffers without first validating that the copy length fit within the destination. Because these functions process externally-supplied data arriving over RPC, an attacker could potentially trigger heap or stack corruption remotely. The fix adds strict bounds and null-pointer checks before any memory operation takes place.

#buffer-overflow#cpp#memory-safety+4 more
O
orbisai0security
May 28, 2026
critical7 min

Heap Buffer Overflow in ShadowsocksR: How a Missing Bounds Check Could Let Attackers Crash Your Server

A critical heap buffer overflow vulnerability was discovered in ShadowsocksR-libev's server.c, where network-supplied data was copied into fixed-size heap buffers without verifying that the source length fit within the destination. An attacker could craft a malicious packet with an oversized length field to overflow the heap, potentially enabling remote code execution or denial of service. The fix adds proper bounds checking, null pointer validation after memory allocation, and reallocation fail

#buffer-overflow#c-security#memory-safety+4 more
O
orbisai0security
May 28, 2026
critical9 min

Kernel Memory Corruption via eBPF Buffer Overflow: How a Static Assert Saved the Day

A critical vulnerability in an eBPF helper function allowed potential out-of-bounds memory reads and writes in kernel context due to unvalidated buffer size assumptions in chunked memory comparisons. The fix introduces a compile-time static assertion that enforces alignment invariants, ensuring that any future change to buffer size constants will produce a build error rather than silently introducing kernel memory corruption. Because eBPF programs execute with kernel privileges, this class of bu

#ebpf#kernel-security#buffer-overflow+4 more
O
orbisai0security
May 28, 2026
critical9 min

Command Injection via os.system() in DeepSpeed's Data Analyzer: A Critical Fix

A critical command injection vulnerability was discovered in DeepSpeed's `data_analyzer.py`, where an `os.system()` call directly interpolated an unsanitized file path variable into a shell command string. An attacker who could influence dataset configuration or file paths could execute arbitrary shell commands on the host machine. The fix replaces the dangerous shell invocation with safe, Python-native file operations that never touch a shell interpreter.

#command-injection#python#deepspeed+4 more
O
orbisai0security
May 28, 2026
critical8 min

How API Key Leakage in Error Messages Gets You Pwned

A critical vulnerability in `gemini-eval.mjs` allowed a live API key to be printed directly into error logs and console output whenever the Gemini API returned an error message containing the key string. The fix introduces runtime redaction of the API key from all error messages before they are logged, preventing accidental exposure in CI/CD pipelines, terminal history, and log aggregation systems. This is a textbook example of how secrets can leak through indirect channels even when developers

#api-security#secret-management#javascript+4 more
O
orbisai0security
May 28, 2026
high7 min

CVE-2026-40073: How a BODY_SIZE_LIMIT Bypass in @sveltejs/adapter-node Put Your App at Risk

CVE-2026-40073 is a high-severity vulnerability in `@sveltejs/adapter-node` that allows attackers to bypass the `BODY_SIZE_LIMIT` configuration, potentially enabling denial-of-service attacks and resource exhaustion against SvelteKit applications. The vulnerability was silently present in versions prior to `@sveltejs/kit` 2.57.1, and has now been patched by upgrading the dependency across all affected project examples. If your application relies on body size limits to protect against oversized p

#svelte#sveltekit#cve+4 more
O
orbisai0security
May 28, 2026
medium7 min

Integer Overflow in Packet Reassembly: How One Missing Check Enables Heap Corruption

A critical heap buffer overflow vulnerability was discovered in the network packet reassembly function of `net_channel_ex.c`, where an attacker-controlled `bodylen` field could be used to corrupt heap memory without any bounds validation. The fix introduces a simple yet effective integer overflow check before accumulating packet body lengths, preventing malformed packets from triggering memory corruption. This type of vulnerability is a stark reminder that even low-level arithmetic operations in

#buffer-overflow#integer-overflow#network-security+4 more
O
orbisai0security
May 28, 2026