PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVR: The Mines of Kakadûm

bughunters.google.com | blog | #cloud | #rce | #vulnerability-research | #memory-corruption | #image-parsing | #google | #kakadu | #jpeg2000
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Google's CVR team details memory corruption bugs in the Kakadu JPEG 2000 image library and shows how 'Conditional Corruption' overcomes environment constraints to achieve remote code execution.
Published
Collected

Related coverage

research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
Critical · vulnerability · github.com
Heap buffer overflow in scale_nearest_neighbor() via duplicate Alpha planes from nested iden/auxl items
A critical, network-reachable image-decoding flaw can turn an attacker-supplied HEIC/HEIF/AVIF file into code execution; upgrade libheif to v1.23.2.
research · projectzero.google
Blasting Past Webp
A deep dive into WebP image parsing and libwebp exploitation, tracing how memory corruption in the codec can be weaponized and why it became such a widely targeted surface.
Back