Argus Proof of Possession

OP-TEE OS - Heap Underwrite in mbedTLS

2026-08-06T00:00:00-07:00

Executive Summary

sw_crypto_acipher_rsanopad_encrypt() and sw_crypto_acipher_rsanopad_decrypt() in lib/libmbedtls/core/rsa.c copy the caller's input into a modulus-sized scratch buffer so that it sits flush against the end of the buffer. The destination is computed as buf + rsa.len - src_len with no check that src_len <= rsa.len. Both values are size_t, so an input longer than the modulus makes the subtraction wrap to a very large unsigned value and the destination resolves to an address below buf. The following memcpy then writes the entire attacker-supplied input starting there, underwriting the OP-TEE core heap by however many bytes the input exceeded the modulus.

Details

The encrypt path allocates a fixed-size scratch buffer and performs the right-aligned copy without validating the input length:

rsa.len = crypto_bignum_num_bytes((void *)&rsa.N);   /* modulus length */

blen = CFG_CORE_BIGNUM_MAX_BITS / 8;
buf = malloc(blen);
...
memset(buf, 0, blen);
memcpy(buf + rsa.len - src_len, src, src_len);       /* no length check */

For a well-formed input (src_len <= rsa.len) the offset rsa.len - src_len is small and positive and the value lands at the end of the buffer, as intended. For src_len > rsa.len the subtraction underflows, buf + (huge value) wraps back below buf, and the copy runs from buf - (src_len - rsa.len) forwards, so the first src_len - rsa.len bytes land before the allocation.

The decrypt path in the same file carries the identical statement at lib/libmbedtls/core/rsa.c:426.

Impact

Code execution at S-EL1, the highest privilege level in the Secure World.

Duplicate and Independent Discovery

This issue was found independently by Argus CSR and by Ramtine Tofighi Shirazi (ramtine@secmate.dev) of Secmate.dev.

Remediation

Update to an OP-TEE OS core containing a21b322e86af ("drivers: crypto: harden crypto_acipher_rsanopad_{de,en}crypt()"), merged as 7b8b494e0a32. It rejects an input longer than the modulus before the copy is computed.

Timeline

2026-06-24 — Reported to the OP-TEE project with proof-of-concept code
2026-07-30 — Fix submitted upstream as PR #7898
2026-08-03 — Independently reported fix merged upstream as 7b8b494e0a32 (PR #7808)
2026-08-04 — PR #7898 closed as a duplicate of the merged fix
2026-08-06 — Public disclosure

OP-TEE OS - Secure World Panic via NULL Calling Session in the Widevine PTA

2026-08-06T00:00:00-07:00

Executive Summary

The Widevine pseudo-TA restricts itself to a small set of allowed caller UUIDs. To do that, open_session() in core/pta/widevine.c looks up the calling session and immediately reads through it:

struct ts_session *session = ts_get_calling_session();

/* Make sure we are called from a TA */
if (!is_user_ta_ctx(session->ctx))
    return TEE_ERROR_ACCESS_DENIED;

The check assumes a calling session always exists. When the Normal World opens a session on the PTA directly, there is no calling TA on the thread's session stack, ts_get_calling_session() returns NULL, and the very next statement dereferences it. The fault happens at S-EL1 and brings down the OP-TEE core.

Details

ts_get_calling_session() returns the session below the current one on the thread's session stack, which is the caller's session when a Trusted Application invokes the PTA. A direct Normal World open leaves nothing below the PTA's own session, so the function returns NULL rather than a session belonging to a non-TA caller. The guard that was meant to reject non-TA callers is therefore written the wrong way round: it reads the field it needs before it has established that the pointer it came from is valid, and the "not called from a TA" case is exactly the case that makes the pointer NULL.

The UUID allow-list that follows never runs, so the intended access control is not what fails here; the dereference happens first.

Impact

The core panics. Every Secure World service the platform depends on, including secure storage, key handling, attestation, and DRM, is unavailable until the device reboots, and any Normal World process that can reach the TEE device can trigger it at will.

Remediation

Update to an OP-TEE OS core containing 83db7cc0e5b7 ("core: pta: widevine: reject a NULL calling session in open_session"), merged as 0aadfc23407f. The fix rejects the call with TEE_ERROR_ACCESS_DENIED when there is no calling session, before anything is read through the pointer.

Timeline

2026-06-24 — Reported to the OP-TEE project with proof-of-concept code
2026-07-30 — Fix submitted upstream as PR #7899
2026-08-06 — Fix merged upstream as 0aadfc23407f
2026-08-06 — Public disclosure

OP-TEE OS - Use-After-Free via TA_FLAG_CONCURRENT Accepted from User TAs

2026-08-06T00:00:00-07:00

Executive Summary

TA_FLAG_CONCURRENT (BIT32(8)) tells the core to skip the per-context busy lock that normally serialises calls into a Trusted Application. It is meant for pseudo-TAs, which are part of the core and are written for it. Nothing rejected it in a user TA header: TA_FLAGS_MASK is GENMASK_32(13, 0), so bit 8 is inside the range that ldelf/ta_elf.c accepts, and the flag was carried into the loaded TA's context unchanged. An attacker-authored TA that sets it gets concurrent execution on a shared context, which the surrounding code was never written to tolerate, and the result is a use-after-free at S-EL1.

Details

Flag validation in ldelf/ta_elf.c only rejects bits outside the mask:

if (elf->head->flags & ~TA_FLAGS_MASK)
    err(TEE_ERROR_BAD_FORMAT, "Invalid TA flags(s) %#"PRIx32,
        elf->head->flags & ~TA_FLAGS_MASK);

With TA_FLAG_CONCURRENT inside TA_FLAGS_MASK, a user TA can declare it and the check passes. The flag then short-circuits serialisation in core/kernel/tee_ta_manager.c:

static bool tee_ta_try_set_busy(struct tee_ta_ctx *ctx)
{
    bool rc = true;

    if (ctx->flags & TA_FLAG_CONCURRENT)
        return true;   /* skip the busy lock entirely */
    ...

For a single-instance, multi-session TA, every session shares one tee_ta_ctx. With the busy lock skipped, two sessions execute against that shared context at the same time. Both map and unmap their memref parameters against the same address-space region list, uctx->vm_info.regions, and that list is manipulated with no lock of its own because the busy lock was the serialisation. Concurrent inserts, removals, and frees on the shared list corrupt its links and free vm_region nodes while the other session still holds and follows them.

Impact

A use-after-free on core heap objects at S-EL1, that can leade to code execution at S-EL1, the highest privilege level in the Secure World.

Remediation

Update to an OP-TEE OS core containing 51d1beeb59b7 ("core: ldelf: reject TA_FLAG_CONCURRENT for user TAs"), merged as 8794043c4065. A user TA that declares the flag is now rejected at load time, leaving it available only to pseudo-TAs, as documented.

Timeline

2026-06-24 — Reported to the OP-TEE project with proof-of-concept code
2026-07-30 — Fix submitted upstream as PR #7900
2026-08-06 — Fix merged upstream as 8794043c4065
2026-08-06 — Public disclosure

OpenBSD - Inverted TKIP MIC-Failure Countermeasure Condition

2026-08-06T00:00:00-07:00

Executive Summary

ieee80211_michael_mic_failure() in sys/net80211/ieee80211_crypto_tkip.c decides whether a Michael MIC failure should activate TKIP countermeasures. Per IEEE 802.11-2012 §11.4.2.4, and per the comment directly above the code, countermeasures belong on a second MIC failure within 60 seconds of the first. The comparison was written the other way round, so the function returned early exactly when the two failures fell inside the window and fell through into the countermeasure path only when they did not.

Details

The check read:

now = getuptime();
if (ic->ic_tkip_micfail == 0 || ic->ic_tkip_micfail + 60 >= now) {
    ic->ic_tkip_micfail = now;
    ic->ic_tkip_micfail_last_tsc = tsc;
    return;
}

ic_tkip_micfail + 60 >= now is true while 60 seconds or less have elapsed since the previous failure, which is the case the standard wants countermeasures for, and that is the branch that returns without acting. Once more than 60 seconds have passed the condition is false, control falls through, and the countermeasures run. The operator needed to be <.

The countermeasure path is not cheap. In HostAP mode it sets IEEE80211_F_COUNTERM, refuses new TKIP associations for 60 to 90 seconds, deauthenticates every associated TKIP station through ieee80211_iterate_nodes(ic, ieee80211_tkip_deauth, ic), and schedules a GTK change. In STA mode it sends two MIC failure reports and deauthenticates from the AP.

Reachability

Both entry points are reachable from received frames with no authentication: the decryption path via ieee80211_tkip_decrypt(), and the EAPOL path via ieee80211_pae_input.c. An attacker only needs to be within RF range of the interface.

Impact

Two consequences, in opposite directions.

An attacker in range sends one malformed TKIP frame, waits more than 60 seconds, then sends a second. Because the failures fall outside the window, the countermeasures activate: on an access point that tears down every TKIP client and blocks reassociation for up to 90 seconds. The sequence is repeatable indefinitely and needs no credentials, which turns the defense itself into a remote denial of service.

In the other direction, a Beck-Tews style key-cracking attempt produces its MIC failures in quick succession, inside the 60-second window, and those are precisely the ones the inverted test discards. The mechanism that exists to deter that attack does not engage.

Exposure is bounded by configuration rather than by the bug: TKIP is disabled by default on OpenBSD, so only WPA1/TKIP deployments are affected.

Remediation

Update to a kernel containing 1ee99dfcc4d, which changes the comparison to ic->ic_tkip_micfail + 60 < now.

Timeline

2026-06-18 — Reported to OpenBSD
2026-07-15 — Fixed in 1ee99dfcc4d (ieee80211_crypto_tkip.c rev 1.34)
2026-08-06 — Public disclosure

OP-TEE OS - RSA NOPAD Heap Underwrite in the NXP SE050 Crypto Driver

2026-08-06T00:00:00-07:00

Executive Summary

decrypt_nopad() and encrypt_nopad() in core/drivers/crypto/se050/core/rsa.c right-align the caller's input in a scratch buffer with memcpy(buf + rsa_len - src_len, src, src_len) and never check that src_len <= rsa_len. Both are size_t, so an input longer than the modulus wraps the subtraction to a very large unsigned value, the destination resolves below buf, and the copy writes the attacker's input starting there.

Details

Both functions follow the same shape. The scratch buffer comes from the mempool, the modulus size is read from the key, and the copy is computed straight from the difference:

buf = mempool_calloc(mempool_default, 1, blen);
...
rsa_len = crypto_bignum_num_bytes(key->n);
memcpy(buf + rsa_len - src_len, src, src_len);   /* no length check */

In the current tree that is core/drivers/crypto/se050/core/rsa.c:356 in decrypt_nopad() (allocation at 349, modulus at 355) and :418 in encrypt_nopad() (allocation at 411, modulus at 417). With rsa_len 256 and src_len 257, the offset becomes 0xFFFFFFFFFFFFFFFF and the copy begins one byte before the allocation, running forward over it.

The driver is compiled when the SE050 RSA driver is enabled, CFG_NXP_SE05X_RSA_DRV, which defaults to y wherever the SE050 crypto driver itself is built.

Impact

Code execution at S-EL1, the highest privilege level in the Secure World.

Remediation

Update to an OP-TEE OS core containing b34895c098ec ("crypto: drivers: se050: check src_len <= modulus size"), merged as 7b8b494e0a32. It adds the bounds check to both NOPAD paths before the offset is computed.

Duplicate and Independent Discovery

This issue was found independently by Argus CSR and by Ramtine Tofighi Shirazi (ramtine@secmate.dev) of Secmate.dev.

Timeline

2026-06-24 — Reported to the OP-TEE project with proof-of-concept code
2026-07-30 — Fix submitted upstream as PR #7898
2026-08-03 — Independently reported fix merged upstream as 7b8b494e0a32 (PR #7808)
2026-08-04 — PR #7898 closed as a duplicate of the merged fix
2026-08-06 — Public disclosure

Unbounded string-length scan in ███

2026-06-22T00:00:00-07:00

Report digest

87a45f9a5c0b7616fbbfcd10aa5e4191d86ff72fcca66387f9289f94870ea2c9  report.md

Unbounded string-length scan in █████

2026-06-22T00:00:00-07:00

Report digest

8d6bc76b050c4758ada56722d0fc9ec18ba8f2002aa4a506e534d2a47735f34c  report.md

Unbounded string-length scan in ███

2026-06-22T00:00:00-07:00

Report digest

5d8247cb39fc05cf8494fdfba0c050881abdc744d111577a5150be0aad203824  report.md

Fixed-Size CopyMem Reads in ████

2026-06-22T00:00:00-07:00

Report digest

32aefedcef229d5cb533a43cee75a2d665c9359ab29f5feec77defbb2fe610e7  report.md

Unbounded string-length scan in ████ ████ ██████

2026-06-22T00:00:00-07:00

Report digest

8126212add36afcb1be8d3e90d436d7ac6318d04e7bc2c644f5bc44498f5b162  report.md

Unbounded string-length scan in ████ ████ ██████

2026-06-22T00:00:00-07:00

Report digest

347ad2b38c090a486d84302fb5610b786e98c30c2815905787549f1c8e7eb324  report.md

███████ address bounds handling

2026-06-22T00:00:00-07:00

Report digest

e4cd27a1227907d3650b3567afd5e2335d6ed714c2c1e7fcafa4d10df917075d  report.md

███████ bounds handling

2026-06-22T00:00:00-07:00

Report digest

3941c34e161f5094b0dff1638cf12033233e0d32991f8f53a8f319ef72accae7  report.md

███████ entry-point bounds handling

2026-06-22T00:00:00-07:00

Report digest

268a84b1965702418ae90e43d3d33c4c7d0edd264b3a28fe93a88223005fd4ab  report.md

Internal ███████ entry-point validation

2026-06-22T00:00:00-07:00

Report digest

2a277968293f8df05812a7a6f7c975214284d2860637e942c3b20d749c8ea95c  report.md

Internal ███████ entry-point validation path

2026-06-22T00:00:00-07:00

Report digest

cc07b6c5d59fd31838bd80791f425eac6de39db0536afca0ce06133808311f20  report.md

Guided section extraction and █████

2026-06-22T00:00:00-07:00

Report digest

51571a2e088cf7738df0a2aa875b0380de24b1d8420f8bd57a9158cfe4d29f5a  report.md

Unbounded string-length scan in ███

2026-06-22T00:00:00-07:00

Report digest

3c251e8bdf9c02e2bef96e11865e9352b661c506f031f9b451029f12e214b7df  report.md

Stack Buffer Overflow in ████

2026-06-22T00:00:00-07:00

Report digest

21c5de919e0d65e9506b3b829f770eca192129e86347e0bd9c23235d14d6b6a1  report.md

Stack Buffer Overflow in ████

2026-06-22T00:00:00-07:00

Report digest

5561f04659fe92191f6ec96fc4d37d19dd2de820cbccff26eda113898c47b0fb  report.md

Stack Buffer Overflow in ████

2026-06-22T00:00:00-07:00

Report digest

86f78ec99011af5eaef1a9f2b135c8798b14933c813bc7aa044d982d793e0002  report.md

Heap Buffer Overflow in ████

2026-06-22T00:00:00-07:00

Report digest

0c39c6b23fbc79fa29c5a28b3e7db64ee0fbeb1300365434cff3f140ca4da0a5  report.md

Heap Buffer Overflow in ████

2026-06-22T00:00:00-07:00

Report digest

51c5d3ce39b6227ddc8c073faca2b89beb7c1ee02cf2b545b83ba542657cb7f4  report.md

Improper Validation of Array Index in ████

2026-06-22T00:00:00-07:00

Report digest

b17c4f8e37ab76559bd2c3b18c3b0f0fe65b52ed8d94ae5edecb3fc5f6e092b5  report.md

Improper Validation of Array Index in ████

2026-06-22T00:00:00-07:00

Report digest

7d4c7a1fdc209af81765044a306c0efea6adcf7729c92669b7b9aa96e4b25699  report.md

Improper Validation of Array Index in ████

2026-06-22T00:00:00-07:00

Report digest

839358c63f11cfd6b95a2ff08702ea934a02a4c7195c3a87ac87788b8ce87ae2  report.md

Improper Validation of Array Index in ████

2026-06-22T00:00:00-07:00

Report digest

e7c0f0a4ec2323a585716217a9ec518280372adb7406d69782739d3fc70701f2  report.md

██████ parser OOB read

2026-06-22T00:00:00-07:00

Report digest

c1be225328edd1c839ce407d238acf5332cc2b5b25dbc8ac6904f07fc44ba14d  report.md

██████ parser OOB read

2026-06-22T00:00:00-07:00

Report digest

86a2fc99565ce27ef7555bdbdef539c3227fbd9278f65d519c3d4a791a2a71fd  report.md

██████ parser OOB read in ████

2026-06-22T00:00:00-07:00

Report digest

cbd129be13920d7bfd9923bfabfd2c19a24cf3ff87c3c664c786188b62bc7f40  report.md

██████ parser OOB read

2026-06-22T00:00:00-07:00

Report digest

5d5f85ac4f83eac9e0548bb3c931604706e0020b472565aa27999322d510b485  report.md

███ ██████ parser OOB read

2026-06-22T00:00:00-07:00

Report digest

7f9451144de3b052aae75a73dfb8036fa89e897ec259af4444bcf51d24f3a0c9  report.md

███ ██████ parser OOB read

2026-06-22T00:00:00-07:00

Report digest

19f24ce5a2abfb2c51edee8503f7e64d4598270ecfd09bc6907c4b393a71e54d  report.md

███ ██████ parser loop OOB read

2026-06-22T00:00:00-07:00

Report digest

683bd04aea5317dd2c5751a106389b9e906b9c7e6e595abab59bc38c9201105f  report.md

████ ████ ██████ parser OOB read

2026-06-22T00:00:00-07:00

Report digest

eeec00ae742d9133eb75408b2c66f4bc2a26c279c29edf355cb2d538fdf2dbf3  report.md

████ ████ ██████ parser loop OOB read

2026-06-22T00:00:00-07:00

Report digest

5de141040abb32dfeb75ec3d7550a3cfb7b196a8c42742388df4131d7ea87d33  report.md

███ █████ parser OOB read

2026-06-22T00:00:00-07:00

Report digest

7c66a27352533955f2a23b163497dc7a9a99f37a76a6f7b123a7c4e73b10b946  report.md

████ shift validation issue

2026-06-22T00:00:00-07:00

Report digest

b978f62d6c7c17e4d554b483be86c838f286debbb6c6fe332983c3878695cffa  report.md

████ shift validation issue

2026-06-22T00:00:00-07:00

Report digest

77d50aae5ede8f5375f2e84c69b93b435c411e028c6c338188d7836f050a74b5  report.md

████ shift validation issue

2026-06-22T00:00:00-07:00

Report digest

937d8718cca7114e13aac00f61578e4a116c5af0c0f6503921b099245226d874  report.md

████ shift validation issue

2026-06-22T00:00:00-07:00

Report digest

cd23e260cd5374bc95dbaa7d01158195a09fb67ff151709918cb8907d6d078f5  report.md

████ shift validation issue

2026-06-22T00:00:00-07:00

Report digest

2a3fb97e8397c83bc466a9e271a615e2249e8dd58ccbcce2915f87e8b83a3968  report.md

███ alignment shift validation issue

2026-06-22T00:00:00-07:00

Report digest

df4f016561f7d0839e61f1bcf068db4d45196c213613f805b072af12583854d6  report.md

█████ alignment shift validation issue

2026-06-22T00:00:00-07:00

Report digest

c48e8ea691ae85edc7ac1970dc8229a2ad94f4cfa6ed6da9fb6d7afdbe9051d3  report.md

███ alignment shift validation issue

2026-06-22T00:00:00-07:00

Report digest

faaeeaf84fd0da28e00df789abbd5e0f565bf4e1588708ee9ba7833183eb775b  report.md

███ alignment shift validation issue

2026-06-22T00:00:00-07:00

Report digest

fc2aaf252171b1db75ff9a522ff6fd04be9bfe1205198627ac0b3fecad0a489b  report.md

Double-Free in ████

2026-06-22T00:00:00-07:00

Report digest

c43082838153d1801e300005840595367cb766ca465d0b979e8734f67bbb07b6  report.md

Double-Free in ████

2026-06-22T00:00:00-07:00

Report digest

6cee12eff450774a541331679022b53cd7ef3155e9ad877c17e7a7f5b28bf0a5  report.md

Silent discard of ████ error return

2026-06-22T00:00:00-07:00

Report digest

5cc3a3eb9e2de2307e5705ca9237c65515555f140bc811cf9151c72400991915  report.md

Off-by-One Null Terminator in ████

2026-06-22T00:00:00-07:00

Report digest

f8c0ec0951ecded1da4d44b1b3fc9d4196c76c544cd1117301bb51c9225cf692  report.md

Off-by-One Null Terminator in ████

2026-06-22T00:00:00-07:00

Report digest

c9e4a86e5f51475e20da528eff93f0a64aaf8bf063305c9959d5e1ed2879ea8e  report.md

Dead-store memset in █████ signing flow

2026-06-22T00:00:00-07:00

Report digest

ae17bef2d3619c62467db57c1c0ecee235c28697d04c0b19d970a47809022fb0  report.md

Integer Overflow in ████

2026-06-22T00:00:00-07:00

Report digest

f262d3ae1fd7e73f5c330a88c6e9e941d7b608356a90260a6317176245071273  report.md

Integer Overflow in ████

2026-06-22T00:00:00-07:00

Report digest

10ad533481349c09ab73c204475a00d179f2a4496955838d147d1c541b36b0dd  report.md

Integer Underflow in ████

2026-06-22T00:00:00-07:00

Report digest

fcec5d9d2a67d3e41556c6feebdc74ab6201019ec971c1b94eebdffbd15bb572  report.md

Integer Underflow in ████

2026-06-22T00:00:00-07:00

Report digest

e60b776db17e6fb36fa63459ef529d1383eb0f4cfa9a410230462d840c04a03f  report.md

Unclamped ███████ index in ██████

2026-06-22T00:00:00-07:00

Report digest

98604336c297a921a3a7e1d25e12c75217fc5ca655df4384ea6f3250f6e1c1f1  report.md

███████ ███████████ reallocation handling

2026-06-22T00:00:00-07:00

Report digest

1fff9e13b7deb30fe2114095d102ef6a2e31148ee78a6d6edad30843787f13e3  report.md

███████ ███████████ runtime reallocation handling

2026-06-22T00:00:00-07:00

Report digest

bcd162b92a6733edbe84263cec5ef634949cf03404670a12ceeba7a7004db9ea  report.md

███████ ███████████ base-memory reallocation handling

2026-06-22T00:00:00-07:00

Report digest

8b48a0da1c36d81bfbc073c3afde7507b940335a1e3f7a287f043ed0580e188e  report.md

███████ ███████████ base-memory free handling

2026-06-22T00:00:00-07:00

Report digest

6f27c3f709e9cfc753ac6d784d19e700f49e474ac831ebc1d0431a730ce6002c  report.md

███████ ███████████ runtime-memory reallocation handling

2026-06-22T00:00:00-07:00

Report digest

50de3c7ac39b298b60b677255b46f8289530138d043ef7a4c119797dc339631c  report.md

███████ ███████████ runtime-memory free handling

2026-06-22T00:00:00-07:00

Report digest

215df48a17b29d73e0647ce01a30d531d7b1e2f516bb220616e645bd9164fbb4  report.md

██████████ memory free handling

2026-06-22T00:00:00-07:00

Report digest

77242fbd2549ec2b2e3a17315881390a3489d2613f7ff91f3c1ee8a870ad50b4  report.md

Integer Coercion Error in ██████████████ ███████████

2026-06-22T00:00:00-07:00

Report digest

a1330cf1a156fe36c644b6e69e4382d604e112c482f0fa941d9b6fb499d2e78f  report.md

Integer Coercion Error in ██████████ ███████████

2026-06-22T00:00:00-07:00

Report digest

d792f257acde6b9c2b16d9b7c34e842c1ef616ad0c483a51b8bbe989e6aee366  report.md

█████████████ Truncates 64-bit ████████ in Heap Allocation

2026-06-22T00:00:00-07:00

Report digest

55e9dcb53d562780fca933675c91139fe79cde1a8728c76878c2a947b32bf164  report.md

██████████████ Truncates 64-bit ███████████████ to UINT32

2026-06-22T00:00:00-07:00

Report digest

c67d584943df20f07be28cbd09d2038c7167879004c2a423526df9b9840b4dcf  report.md

████████████ Truncates 64-bit ███████████████ to UINT32

2026-06-22T00:00:00-07:00

Report digest

cfe308c14076ce64002b9bf46a75b800f41d6180b42ff5858297bc3b8439e960  report.md

█████████████ Truncates 64-bit ████████████████████ to UINT32

2026-06-22T00:00:00-07:00

Report digest

35a824f3dd7837093b1cfa053ce4aa9c51252b92c3f87b0f3a91212b7bc8aee4  report.md

█████████████ Truncates 64-bit ████████████████████ to UINT32

2026-06-22T00:00:00-07:00

Report digest

c3583c19e535e13d6bc7ae875152b1f3a82bdd126187752b7a1fca6a79267f74  report.md

█████ Buffer Leak in ███ Parser

2026-06-22T00:00:00-07:00

Report digest

14d950d4bd09a1a7f3917f0479edbd5b86a7337b6f8f71d09ded6f926d19aa8e  report.md

Cleanup Chain Bypass on ████ ████ ██████████

2026-06-22T00:00:00-07:00

Report digest

05fc54e258382a584f53af289791cb4c2c441e08dfa90fcc18a5e7e06ed1d404  report.md

Wrong variable passed to variadic print in ████████████ dump

2026-06-22T00:00:00-07:00

Report digest

effc2e3f9fad4d032e49c3d5e36c802ca41f8e9622fd95b6311a1ab9ffa112f1  report.md

Missing argument causing null-pointer dereference in ████ parser

2026-06-22T00:00:00-07:00

Report digest

0ddefb9605aa06d3e1035090edb6cc1613dec95b73a1e805e0d8e52a93298e12  report.md

████ parser missing format argument

2026-06-22T00:00:00-07:00

Report digest

fa86a17d3c3972b7cea5c32a22d844f9b59b028c353672d89acaa80a8917b309  report.md

████████████ missing format argument

2026-06-22T00:00:00-07:00

Report digest

906f297bc466c181c77e5bb563b8ab56087da15f830871a66e948801809a33ef  report.md

ASSERT-Only Allocations Sized by ██████ in ███████████

2026-06-22T00:00:00-07:00

Report digest

16206f351722ecee0d9c228949dd10e7df511e55833a3b40861bef6f54016a49  report.md

Multiple Unchecked Allocations in █████████████████████

2026-06-22T00:00:00-07:00

Report digest

8d7ef39e6e0e87bb3a46bd453986c6e31492e766d15207a8302a1798d7a319f4  report.md

Unchecked ████████████████████ Allocations in █████████████████████████

2026-06-22T00:00:00-07:00

Report digest

895144244b2af920d0659fde856366701633b7299fcdbe086b06ec44d1bb8f5a  report.md

Unchecked ████████████████████ Allocations in ███████████████████████████

2026-06-22T00:00:00-07:00

Report digest

06f6f030a74c137b4fb93c37ca1730533f24e5a24df672bf01a20c50984d5221  report.md

Unchecked █████████████ Allocation in ███████████████████

2026-06-22T00:00:00-07:00

Report digest

8685cf2e4e8a1cc29e6144cb5373dd66a8b7588a1689a466f145d87ef1f9dc16  report.md

Unchecked Allocations in ███████████████████

2026-06-22T00:00:00-07:00

Report digest

c4e635fd4c9afdb869496f5953b6e6bd4c9578a4fc26fb81f009c256baea8c2f  report.md

ASSERT-Only Allocation in █████████████████████

2026-06-22T00:00:00-07:00

Report digest

f033d48d2ca61ad6ac5f6294fe618dda2c185f702d9cc30bf58a6a08fdb11a23  report.md

ASSERT-Only Allocation in ██████████████████

2026-06-22T00:00:00-07:00

Report digest

9b32c9defa85297e56ed88ede312b3e91c7d014b69da0ede7dffdf20d4bc9438  report.md

ASSERT-Only Allocations in ██████████████

2026-06-22T00:00:00-07:00

Report digest

8821ebcb2ea82401a4475543c4874b3ff9e5f2d30e44b0d31bf5f418bb2fde23  report.md

Multiple Unchecked Allocations in ███████████████████████

2026-06-22T00:00:00-07:00

Report digest

3b0353b1925f0930d60a9a3af6284eddc2734581a08ff0378b459c5ddbd8e092  report.md

Unchecked AllocatePool in ████████████████████

2026-06-22T00:00:00-07:00

Report digest

8c1d1168c02fd153a6a31ab0f435ff92d54df83b58ea76e8cc014bdc3177ccbe  report.md

Multiple Unchecked Allocations in █████████████████████████

2026-06-22T00:00:00-07:00

Report digest

3b79c8b378e171a296a822523e7e51d6d479ab0945aa36194813cbee1e0a09b8  report.md

Unchecked ████████████████████ Allocations in ████████████████

2026-06-22T00:00:00-07:00

Report digest

a55899de06cc042b4d0631a283df1eef19060818a7b4c34ab762f25da5c9e344  report.md

Unchecked ████████████████████ Allocations in ██████████████████

2026-06-22T00:00:00-07:00

Report digest

91b6a0809158c76dca56ae71a376b4228390b8d70d749d1f300e3229b53835aa  report.md

ASSERT-Only Allocation in ████████

2026-06-22T00:00:00-07:00

Report digest

0156a7b294c9d87fd882932a3dcfedfaad792a38df21c91a9fb4a9f4e054ebe0  report.md

Unchecked AllocatePool in ████████

2026-06-22T00:00:00-07:00

Report digest

c3e9d6052d40d87c25fda79554e43e4aa80372389e91dc963bd0b08c2632b3f3  report.md

ASSERT-Only Allocation in ████████████

2026-06-22T00:00:00-07:00

Report digest

8f4c4c353eb1a7a6ed86eda433563efee01c485828588e4f3a7c605545913c98  report.md

Unchecked AllocateZeroPool in █████████████

2026-06-22T00:00:00-07:00

Report digest

795f8a599dc3ccd9488f488f4035df5573d96a427e98eaad98db95b118828ad4  report.md

Unchecked AllocateZeroPool in █████████████████████

2026-06-22T00:00:00-07:00

Report digest

c2ce14ce82e42ca0a773649b279888d76058b162db12ef694db06875cdd49f03  report.md

Unchecked AllocatePool ██████ in ████████████████████

2026-06-22T00:00:00-07:00

Report digest

b83fde6e1611560da94a9de8615c2515f795a69aa11fe5b1e93d42a7105afc7c  report.md

Unchecked AllocateZeroPool for ██████ in ████████████████████

2026-06-22T00:00:00-07:00

Report digest

4d96c953ccaafad9f4937cb963fbc6fb83366c05214402629f116a700f512b7f  report.md

Unchecked AllocateZeroPool in █████████████████

2026-06-22T00:00:00-07:00

Report digest

99b2da26b3ee479185466b83c5a73a8e2d955a005c89d715a44a058ee3a9c772  report.md

ASSERT-Only Guard on Allocation in ████████████████

2026-06-22T00:00:00-07:00

Report digest

94373c6dc994e17c29efe17deca38d0df772a896722879a8934f5ca64d2b99af  report.md