Research

Vulnerabilities I have reported, and public bugs I rebuilt end to end from the advisory. Findings still under coordinated disclosure are added once the vendor has shipped a fix.

1. CVE-2023-421152026

   Exim SMTP AUTH out-of-bounds write

   Unauthenticated out-of-bounds write in the SMTP AUTH handler; reproduced the bug and the path to code execution.

   1-day reproduction
2. CVE-2025-554232026

   ipTIME UPnP OS command injection

   Command injection in the UPnP service; root-cause analysis and reproduction on real firmware.

   1-day reproduction
3. CVE-2026-20052026

   PostgreSQL pgcrypto heap overflow

   Integer overflow in PGP session-key parsing leading to a heap overflow; built a working exploit from the advisory.

   1-day reproduction