Security Research

Security Blog

Page 5

critical8 min

Critical Buffer Overflow in iiod Parser: How a Missing Bounds Check Opened the Door to Remote Code Execution

A critical buffer overflow vulnerability was discovered in the `iiod` parser's `yy_input()` function, where an off-by-one bounds check allowed an oversized network input stream to overflow a fixed-size buffer, potentially overwriting adjacent stack or heap memory. Because this code path is reachable from the network without authentication, a remote attacker could exploit this flaw to achieve arbitrary code execution. The fix tightens the bounds enforcement and ensures the function returns the co

#buffer-overflow#c#parser+4 more
O
orbisai0security
May 28, 2026
critical7 min

Heap Overflow in LZMA Decompression: When Attacker-Controlled Data Meets memcpy

A critical heap buffer overflow vulnerability was discovered in the LZMA decompression library (`LzmaDec.c`), where attacker-controlled compressed input could manipulate copy lengths passed directly to `memcpy` without bounds validation. This class of vulnerability can allow attackers to overwrite adjacent heap memory, potentially leading to arbitrary code execution or process crashes. A targeted bounds check was added to validate the output size before the copy operation, closing the attack pat

#buffer-overflow#memory-safety#lzma+4 more
O
orbisai0security
May 28, 2026
critical8 min

Integer Overflow to Heap Buffer Overflow: How a Missing Size Check Almost Took Down an Embedded Web Server

A critical integer overflow vulnerability (CWE-190 → CWE-122) was discovered and fixed in an embedded ESP web server, where the HTTP Content-Length header value was cast to a signed integer and used directly in a `malloc()` call without proper size validation. On 32-bit systems, a crafted request with a maximum-sized Content-Length value could cause the allocation size to wrap to zero, allowing an attacker to overflow the heap with arbitrary data. The fix correctly validates the signed header va

#c#embedded-security#buffer-overflow+4 more
O
orbisai0security
May 28, 2026
high7 min

Chained Memory Safety Vulnerabilities: How a Malicious Source File Could Compromise Your Build System

A high-severity vulnerability in `src/parser/koala.l` allowed an attacker to craft a malicious `.kl` source file that, when parsed by the Koala compiler, could trigger a chain of memory safety bugs — integer overflow, use-after-free, and out-of-bounds access — ultimately enabling arbitrary code execution at the privilege level of the compiler process. The fix introduces strict input validation guards that break this exploitation chain before it can begin. This is a reminder that parsers and comp

#memory-safety#integer-overflow#buffer-overflow+4 more
O
orbisai0security
May 28, 2026
high9 min

Stack Corruption on ESP32: When memcpy Reads Beyond UART Buffer Bounds

A high-severity vulnerability in ESP32 firmware allowed attackers to trigger stack and heap corruption by sending malformed UART frames shorter than expected to an mmWave sensor driver. Multiple `memcpy` operations copied data into fixed-size local variables without first verifying the source buffer was large enough, opening the door to arbitrary code execution. The fix replaces magic-number length guards with `sizeof()`-based checks that are portable, self-documenting, and provably correct.

#embedded-security#esp32#buffer-overflow+4 more
O
orbisai0security
May 28, 2026
high8 min

Stack Buffer Overflow in fontconvert.c: How strcpy() Without Bounds Checking Can Crash Your System

A high-severity stack buffer overflow vulnerability was discovered in the Adafruit GFX Library's `fontconvert` tool, where an unchecked `strcpy()` call could allow an attacker or malformed input to overwrite adjacent stack memory — including the saved return address. The fix replaces unsafe C string functions with bounds-checked alternatives (`snprintf`), closing a classic CWE-120 vulnerability that has plagued C codebases for decades. While the tool is primarily used during development, exploit

#buffer-overflow#c-security#cwe-120+4 more
O
orbisai0security
May 28, 2026
critical8 min

Heap Corruption in Dynamic App Loaders: How Unvalidated Binary Size Fields Open the Door to Memory Attacks

A critical heap corruption vulnerability was discovered in a dynamic application loader where size values read directly from untrusted binary files were used to drive memory operations without any bounds validation. An attacker supplying a crafted app binary could overflow heap buffers, corrupt memory, and potentially achieve arbitrary code execution. The fix introduces strict bounds checks before memory operations and replaces unsafe allocation patterns with overflow-safe alternatives.

#c#memory-safety#heap-overflow+4 more
O
orbisai0security
May 28, 2026
medium8 min

HTTP Basic Auth Over Plain HTTP: How ESP32 Credentials Were Exposed on Your Wi-Fi

A medium-severity vulnerability in the ESP32-audioI2S library allowed audio streaming credentials to be transmitted via HTTP Basic Authentication over unencrypted HTTP connections, making them trivially recoverable by anyone on the same network. The fix gates the Authorization header behind an SSL/TLS check, ensuring credentials are only sent when the connection is encrypted. For embedded IoT devices where credentials are often hardcoded in firmware, this kind of passive interception risk is esp

#esp32#iot-security#http-basic-auth+4 more
O
orbisai0security
May 28, 2026
high7 min

Buffer Overflow in Meshtastic: How One Missing Bounds Check Opens the Door to Remote Code Execution

A critical buffer overflow vulnerability was discovered in the Meshtastic firmware's radio packet handler, where an unchecked `memcpy` operation allowed any node on the mesh network to send a crafted packet with an oversized payload length field, potentially overwriting adjacent memory. Because Meshtastic mesh nodes communicate without authentication, this vulnerability was remotely exploitable by any attacker within radio range — or even further through mesh relay. The fix adds a simple but ess

#buffer-overflow#embedded-security#meshtastic+4 more
O
orbisai0security
May 28, 2026
critical8 min

Integer Overflow to Heap Corruption: Fixing a Critical Buffer Overflow in C Memory Allocation

A critical integer overflow vulnerability was discovered in a C-based audio reader where `malloc()` was called with an unchecked multiplication of `n_samples * sizeof(float)`, allowing heap buffer overflows through attacker-controlled input. The fix replaces raw `malloc()` calls with Ruby's safe `ALLOC_N` macro and wraps allocation logic in a protected, exception-safe block. This prevents heap memory corruption that could lead to arbitrary code execution or application crashes.

#c#buffer-overflow#integer-overflow+4 more
O
orbisai0security
May 28, 2026
high7 min

Heap Buffer Overflow in stb_image.h: How a Missing Bounds Check Could Lead to Code Execution

A critical heap buffer overflow vulnerability was discovered and patched in a vendored copy of `stb_image.h`, a popular single-header image loading library. The root cause was a missing bounds check that allowed attacker-controlled image data to trigger memory writes beyond allocated heap buffers, potentially enabling arbitrary code execution. A single defensive guard — rejecting negative buffer lengths before any memory operation — closes this dangerous attack vector.

#buffer-overflow#c-cpp#memory-safety+4 more
O
orbisai0security
May 28, 2026
critical7 min

Go JOSE DoS Vulnerability: Fixing JWE Object Exploitation in Rclone

A high-severity Denial of Service vulnerability (CVE-2026-34986) was discovered in the `github.com/go-jose/go-jose/v4` library, which Rclone depends on for JSON Web Encryption operations. An attacker could craft a malicious JWE object to exhaust server resources and bring down services. The fix is a targeted dependency upgrade from v4.1.3 to v4.1.4 — a minimal change with significant security impact.

#golang#cve#denial-of-service+4 more
O
orbisai0security
May 28, 2026