Security Research

Security Blog

Page 8

high9 min

Buffer Overflow in UPnP Control Point: How a Rogue Device Could Own Your Stack

A high-severity buffer overflow vulnerability (CWE-120) was discovered and patched in the UPnP TV control point sample code, where an unbounded `sprintf` call could allow a malicious device on the network to corrupt stack memory. The fix replaces the unsafe formatting call with a size-bounded alternative, preventing attackers from exploiting crafted UPnP responses to hijack program execution. This post breaks down how the attack works, what the fix looks like, and how you can audit your own C co

#buffer-overflow#c-security#upnp+4 more
O
orbisai0security
May 24, 2026
critical8 min

Buffer Overflow in C: How Unsafe strcpy Almost Broke Everything

A critical buffer overflow vulnerability was discovered and patched in `gimbal_md5.c`, where unsafe C string functions were used without size bounds checking. Left unpatched, this flaw could allow attackers to corrupt memory, crash processes, or execute arbitrary code. The fix replaces unbounded functions with their size-aware counterparts, enforcing a strict invariant: buffer reads must never exceed the declared length.

#buffer-overflow#c-security#memory-safety+4 more
O
orbisai0security
May 23, 2026
critical8 min

Critical Integer Overflow in C: How a Simple Multiplication Almost Caused Heap Corruption

A critical integer overflow vulnerability was discovered and patched in `src/asb_governor.c`, where an unchecked multiplication during buffer reallocation could produce a dangerously undersized heap allocation on 32-bit systems. An attacker with a crafted session file could trigger heap corruption, potentially leading to arbitrary code execution. The fix adds proper overflow detection before any memory allocation, closing a classic but devastating class of memory safety bug.

#integer-overflow#heap-corruption#memory-safety+4 more
O
orbisai0security
May 23, 2026
high9 min

Shell Injection via Unsafe String Concatenation in gRPC Command Generation

A high-severity shell injection vulnerability was discovered in `src/RtlJaguarDevice.cpp`, where user-controlled values from API responses were directly interpolated into gRPCurl command strings without proper shell escaping. An attacker who controls API response data could inject shell metacharacters, causing arbitrary command execution when a user pastes and runs the generated command. The fix applies proper shell escaping to all user-controlled values before they are included in command strin

#security#shell-injection#command-injection+4 more
O
orbisai0security
May 23, 2026
critical9 min

CVE-2025-55182: Critical Next.js RCE via Unsafe Deserialization in RSC

A critical pre-authentication remote code execution vulnerability (CVE-2025-55182) was discovered in Next.js React Server Components, allowing attackers to execute arbitrary code on servers without any login or credentials required. The flaw stems from unsafe deserialization of untrusted data passed through the RSC pipeline. The vulnerability has been patched across multiple Next.js release lines, and all affected projects should upgrade immediately.

#nextjs#remote-code-execution#deserialization+4 more
O
orbisai0security
May 23, 2026
high8 min

Shell Injection via Unsafe String Concatenation in gRPCurl Command Generation

A high-severity shell injection vulnerability was discovered and patched in a distributed server's gRPCurl command generation logic, where user-controlled values from API responses were directly interpolated into shell command strings without proper escaping. An attacker who can influence API response data — such as headers, endpoints, or payloads — could inject shell metacharacters that execute arbitrary commands when a user pastes and runs the generated command. This fix eliminates the risk by

#shell-injection#command-injection#grpc+4 more
O
orbisai0security
May 23, 2026
critical8 min

Critical Buffer Overflow Fixed in kinnie.c: Why Bounded String Functions Matter

A critical memory corruption vulnerability was discovered and patched in kinnie.c, where an unbounded strcpy call could allow a maliciously crafted input file to trigger out-of-bounds array writes and corrupt adjacent memory. The fix replaces the unsafe strcpy with bounded alternatives like strlcpy and snprintf, eliminating the attack surface entirely. This is a textbook example of how a single unsafe C string function can open the door to serious exploitation.

#c#buffer-overflow#memory-safety+4 more
O
orbisai0security
May 22, 2026
high8 min

Shell Injection via gRPCurl Command Generation: A Hidden Android Threat

A high-severity shell injection vulnerability was discovered and fixed in the HeadUnit Revived Android project, where user-controlled API response values were unsafely interpolated into gRPCurl command strings. An attacker could craft malicious headers, endpoints, or data payloads containing shell metacharacters that, when the generated command is pasted and executed, would run arbitrary commands on the victim's machine. The fix introduces proper shell escaping and broadcast intent protection to

#security#shell-injection#android+4 more
O
orbisai0security
May 22, 2026
medium8 min

Heap Buffer Overflow in drawgfx.c: How ROM Dimensions Can Lead to Code Execution

A heap buffer overflow vulnerability in MAME's drawgfx.c allowed attackers to craft malicious ROM files with manipulated width/height values, causing memcpy to write beyond allocated buffer boundaries and potentially overwrite function pointers for arbitrary code execution. The fix introduces proper buffer-length validation before the copy operation, closing a dangerous attack vector that existed wherever untrusted ROM data controlled memory operations. Understanding this class of vulnerability

#buffer-overflow#heap-exploitation#CWE-120+4 more
O
orbisai0security
May 22, 2026
critical8 min

Critical Buffer Overflow in LDAP Module: How sprintf Almost Broke Everything

A critical buffer overflow vulnerability was discovered and patched in an LDAP module where the use of `sprintf` without bounds checking allowed attacker-controlled input to overflow a stack buffer during hex-escape processing. This type of vulnerability can lead to remote code execution, privilege escalation, or full system compromise, making it one of the most dangerous classes of bugs in systems programming. The fix replaces the unchecked `sprintf` call with a bounds-aware alternative, closin

#security#buffer-overflow#c+4 more
O
orbisai0security
May 22, 2026
critical7 min

Integer Overflow to Heap Buffer Overflow: A Critical CVE in OpenCV Image Processing

A critical integer overflow vulnerability was discovered and patched in opencv_functions.cpp, where width × height calculations on 32-bit embedded systems could silently overflow, causing heap buffer overflows that enable arbitrary code execution. This fix eliminates a dangerous attack vector that could be triggered by maliciously crafted image metadata. Understanding this class of vulnerability is essential for any developer working with image processing, embedded systems, or untrusted user inp

#security#c++#integer-overflow+4 more
O
orbisai0security
May 22, 2026
critical9 min

Critical DNS Integer Overflow: How a +1 Nearly Enabled Remote Code Execution

A critical integer overflow vulnerability in DNS record processing code could have allowed a malicious DNS server to trigger a heap buffer overflow, potentially enabling remote code execution. The fix ensures safe bounds checking before performing size calculations, closing a subtle but devastating attack vector that lurks in network-facing C code.

#security#c#dns+4 more
O
orbisai0security
May 22, 2026