21 Bugs in the Linux Bluetooth Stack, Part 2
Five more findings fixed upstream, including the EIR device-name stack overflow (CVE-2026-80186) and three AVRCP browsing-response out-of-bounds reads.
We're a focused research lab at the frontier of AI, Vulnerability Research, and Reverse Engineering.
Published research
Recent writeups
Fuzzing GPSD, Part 3: The Bugs
Eight memory-safety issues from public work item #397, including Skytraq code execution, NMEA format strings, AIS writes, and parser leaks.
Escaping QEMU
A guest-to-host escape through an advisory DMA bounds check that yields both a leak and a write over QEMUTimer callback fields.
lwIP SMTP AUTH overflow
SMTP AUTH-line parsing copies server-controlled EHLO data into tx_buf without a clamp. Part 1 of a 13-part lwIP audit series.
A KVM dirty-ring OOB
A u64 wraparound in kvm_reset_dirty_gfn() sends the reverse-map index 504 bytes before rmap[].
Five CVEs in dnsmasq 2.92
Five vulnerabilities fixed in 2.92rel2, including CVE-2026-2291, DNSSEC parser bugs, a DHCPv6 helper overflow, and an ECS validation bypass.
Capabilities
What we work on
Vulnerability Research
Investigating software and firmware to uncover vulnerabilities and establish their impact.
- Exploit development
Reverse Engineering
Understanding how systems work and adapting them to specific needs.
- Software, firmware, and protocol analysis
- Firmware modification, customization, and tuning
Embedded, Hardware, and RF
Security research across connected devices and their underlying platforms.
- Hardware reverse engineering
- RF and wireless security
- Embedded systems security
Capability Development
Custom engineering for research and operational needs.
- CNO development
- Security research automation
Discuss a project
Tell us about your target system and what you need to understand or build. Include your scope and timeline if you have them.