CVE-2025-43529

CVE-2025-43529 TL; DR Apple은 최근 iOS 26.2 및 iPadOS 26.2를 출시했으며, WebKit 취약점에 대한 수정 사항을 포함한 보안 권고를 발표했습니다. DFG JIT 컴파일러의 한 버그CVE-2025-43529가 눈에 띄어서 살펴보기로 했습니다. JIT 컴파일러는 여러 제어 흐름 경로가 병합되는 Phi 노드가 이스케이프되었음을 올바르게 인식했지만, Phi의 Upsilon 노드도 이스케이프되었음을 감지하지 못했습니다. 이로 인해 DFG 컴파일의 StoreBarrierInsertionPhase가 ...

CVE-2026-74936-gc-potato

CVE-2026-74936 화려하지 않은 재현입니다. 기본 설정에는 약간의 조정이 필요했습니다. Mozilla는 이 이슈를 WebAssembly use-after-free로 설명합니다. 공개 수정본 9823b5c86ffa는 정확히 트래핑하는 wasm::Code를 JitActivation에 살아 있게 유지합니다. 이 테스트는 잘못된 시그니처의 교차 인스턴스 꼬리 호출을 수행합니다. Debugger 언와인드 훅은 테이블의 마지막 대상 참조를 해제하고, 엔진이 트랩을 처리하는 동안 축소 GC를 강제합니다. 꼬리 호출에 진입하기 전에...

CVE-2026-84118-who-labeled-the-crit-as-a-high

CVE-2026-84118 — SpiderMonkey GC use-after-free Bug 2057457 이것은 Mozilla가 Critical을 High로 분류한 사례 중 하나입니다. 그렇다면 누군가 Firefox에 가서 원래 버그 헌터들의 보상을 업데이트하도록 요청하고 싶을 수도 있습니다. 요약: 제어된 포인터에 대해 OOB R 프리미티브를 수행한 다음 해당 포인터를 기준으로 위아래로 이동할 수 있습니다. 제어된 포인터를 배열에 지정하면 재미있는 일을 할 수 있습니다. PoC에는 SEGV 부분만 있으므로 나머지는 배열을...

A-potential-Denial-of-Service-issue-in-protobuf-java

A-potential-Denial-of-Service-issue-in-protobuf-java protobuf-java의 잠재적 서비스 거부Denial of Service 문제 — 높은 심각도, GitHub 검토됨 5일 전 protocolbuffers/protobuf에 게시됨 • 어제 업데이트됨 취약점 세부 정보 Dependabot 알림 2개 패키지 com.google.protobuf:protobuf-java maven 영향을 받는 버전 = 3.18.0, = 3.19.0, = 3.18.0, = 3.19.0, 3.19.2 패치된...

CVE-2025-49844

CVE-2025-49844 – Redis Lua パーサーの Use-After-Free Lua チャンク名の GC レースにより、Redis 8.2.1 で use-after-free とリモートコード実行が発生する問題。 概要 Redis はスクリプト実行のために Lua 5.1 を組み込んでいます。バージョン 8.2.1 までの luaYparser 関数は、レキサーを呼び出す前に Lua スタック上でチャンク名文字列をアンカーしません。細工されたスクリプトは、パーサーが解放済み文字列を参照している間にガベージコレクションを発生させ、ネイティブコード実行につながる UAF...

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

Summary LZ4FrameInputStream allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame header. Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 inpu...

GHSA-GM45-99XC-R7WV yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

Summary LZ4FrameInputStream allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame header. Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 inpu...

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

LZ4FrameInputStream allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame header. Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 input bytes...

CVE-2026-106450 yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

CVE-2026-106450 yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

CVE-2026-106450

Prior to version 1.11.4 , yawkat LZ4 Java is vulnerable to a resource exhaustion issue in the net.jpountz.lz4.LZ4FrameInputStream.readHeader() function. When processing a maximum-block-size frame header in the default concatenated-frame mode, the component allocates two new 4 MiB block buffers. A...

uaf-2023-28205

CVE-2023-28205: Apple WebKit Use-After-Free 취약점 이 취약점은 Apple WebKit에 영향을 미치며, 악의적으로 조작된 웹 콘텐츠를 통해 WebKit 프로세스 컨텍스트에서 임의 코드 실행이 가능해질 수 있습니다. 이 리포지토리에서 분석된 영향받는 WebKit 빌드는 WebKit-613.1.17.1 PlayStation / Safari 15.4 계열을 기반으로 합니다. 설명 PoCProof of Concept는 구조화된 복제 작업 중 Map 및 Date와 같은 JavaScript 객체의 등록...

CVE-2024-2887-REPORT

SSD Advisory – Удалённое выполнение кода в Google Chrome Источник: ssd-disclosure.com/ssd-advisory-google-chrome-rce Краткое описание Критическая уязвимость удалённого выполнения кода в Google Chrome версии 123 и ранее, затрагивающая обработку типов сборщика мусора WebAssembly WASM. Ошибка вызыва...

CVE-2024-44623

CVE-2024-44623 В SPX-GC версии 1.3.0v и ниже, управляемый пользователем ввод передавался в функцию exec модуля childprocess без какой-либо санизации, что приводило к неаутентифицированному слепому удаленному выполнению кода. Уязвимость В /routes/routes-api.js пользовательский ввод, полученный из...

Linux Distros Unpatched Vulnerability : CVE-2026-104855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy,...

GHSA-2HW9-MC66-JC2Q Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime...

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime...

UBUNTU-CVE-2026-104855

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epochdeadlinecallback or continues...

CVE-2026-104855

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epochdeadlinecallback or continues...

RUSTSEC-2026-0325 Mis-typed WebAssembly tag imports can lead to GC heap corruption

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory...