// research write-ups
Write-ups of published research: the finding, the root cause, the evidence and the disclosure. Deep dives with reproducible detail, nothing reposted.
A signed message shorter than one signature made the CROSS reference implementation compute a length close to 2^64 and pass it to memcpy, before verification ran. CVE-2026-41509, scored 9.8 Critical.
Read write-up →Seventy-four bytes of JSON took a vLLM API server's peak memory from 2,271 MiB to 13,629 MiB, and the frame-count ceiling that should have stopped it was sitting on a key the Qwen video samplers never read.
Read write-up →An anonymous embed visitor received the instance owner's private Memories. Not prompt injection: a missing identity that collapsed into the owner's own storage scope. GHSA-8wh8-3v68-whwj, fixed under eleven hours after the report.
Read write-up →Part 1 of 4. The Lenovo WmiBiosSetupSmm disclosure (CVE-2026-10587 to -10590), coordinated with Lenovo PSIRT under case LEN-213632 and published in advisory LEN-220440 on 14 July 2026. Most vulnerability write-ups live in the operating system, the…
Read write-up →Part 2 of 4: the Lenovo WmiBiosSetupSmm disclosure. Start with Part 1 for the architecture and the escalation chain. Part 1 named the target: WmiBiosSetupSmm, software SMI 0xDE, on the Lenovo Legion 5 15IRX10 (BIOS QNCN33WW v1.33, InsydeH2O). This part opens the handler and…
Read write-up →Part 3 of 4: the Lenovo WmiBiosSetupSmm disclosure. See Part 1 (the chain) and Part 2 (the missing validation). Missing size and buffer checks make a handler fragile. Two more gaps make it usable: it authenticates nobody, and it hands the…
Read write-up →Part 4 of 4: the Lenovo WmiBiosSetupSmm disclosure. See Part 1 (the chain), Part 2 (validation), and Part 3 (authorization). The first three parts covered the bugs. This one covers the process, because a firmware finding is only as good…
Read write-up →
