PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Pwning Minecraft: 4-byte heap overflow to RCE

osec.io | research | #rce | #exploit | #memory-corruption | #heap-overflow | #game-security | #minecraft
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec achieves RCE in Minecraft Bedrock, turning a 4-byte heap overflow from a malicious server into full client compromise on Windows, bypassing ASLR and Control Flow Guard.
Published
Collected

Related coverage

research · depthfirst.com
NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability
depthfirst's system found four remote memory-corruption bugs in NGINX, including a 2008-era heap overflow (CVE-2026-42945); a PoC shows RCE with ASLR off. rewrite/set users are at risk.
vulnerability · bishopfox.com
A Bug Has No Name: Multiple Heap Buffer Overflows In the Windows DNS Client
Dissecting CVE-2017-11779: unsafe NSEC3 record parsing in Windows DNSAPI.dll causes multiple heap overflows, and an attacker-controlled DNS server can trigger arbitrary code execution.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
Critical · vulnerability · github.com
Heap buffer overflow in scale_nearest_neighbor() via duplicate Alpha planes from nested iden/auxl items
A critical, network-reachable image-decoding flaw can turn an attacker-supplied HEIC/HEIF/AVIF file into code execution; upgrade libheif to v1.23.2.
research · osec.io
From virtio-snd 0-day to hypervisor escape: exploiting QEMU with an uncontrolled heap overflow
OtterSec turns an uncontrolled heap overflow in QEMU's virtio-snd 0-day into a reliable guest-to-host escape using new glibc allocator behavior and QEMU-specific heap sprays.
research · theori.io
Patch Analysis of MS16–063 (jscript9.dll)
A patch-analysis deep dive into MS16-063: diffing jscript9.dll to locate a TypedArray/DataView memory-corruption bug, then rebuilding it into a working proof-of-concept exploit for Internet Explorer.
Back