Eva Crystal: Independent Security Researcher

About

Since 2025 Eva Crystal has run coordinated disclosures with Lenovo, Insyde, ARM, AMD, Intel, VMware and the Mbed TLS maintainers, holds published CVEs in cryptographic libraries, firmware and the vLLM inference server, and has further disclosures open across AI/ML tooling, from inference servers to agent platforms.

She founded XSource Security, which runs source-level security audits of AI infrastructure, firmware and cryptography. One researcher runs each engagement end to end: scoping, review, reproducing every finding and writing the report.

Trained in software engineering and web development before moving into security, and certified on both the offensive and the defensive side. Every finding is written by someone who knows how it is exploited, how it is detected and how it is fixed: six security fixes authored and merged upstream, including the Linux kernel.

Selected results

10 published CVEs: four in Lenovo BIOS/SMM, four in Mbed TLS, CVE-2026-41509 in the CROSS post-quantum signature scheme (CVSS 9.8) and CVE-2026-105758 in the vLLM inference server.
CVE-2026-104255 in liboqs, assigned and co-credited as an independent report in GHSA-xv6c-h66p-6mfq.
Six upstream fixes authored and merged: two in oqs-provider, two in the SNOVA reference implementation and two in the Linux AMD NPU driver (mainline for Linux 7.4 and the 6.18.57 stable release).
Seven TF-RMM fixes merged upstream with a Reported-by credit.

Every record, with its public reference: Disclosures.

Certifications

OSCP+, CPTS, COAE, C-AI/MLPen, CWES, eCPPTv3, eWPTXv3 and CDSA.

Hands-on

Hack The Box: Grandmaster rank (Pro Hacker), including Sherlocks, HTB’s defensive investigation labs.
Blue Team Labs Online: #15 of 75,000+ defenders (October 2026).

Profiles

Findings are credited as 0xiviel (formerly iiviel) or Eva Crystal (XSource Security). For an audit, use the contact form.