Writeups

Security writeups and technical analyses.

2026-09-21 8 min read

CVE-2026-95622: A cell broadcast that aborts ModemManager's CBM parser

Technical breakdown of a reachable g_assert_not_reached() in ModemManager's Cell Broadcast PDU parser. A g_slice_new0 default leaves the encoding at UNKNOWN for legal but unhandled data coding schemes, and the encoding switch aborts the root daemon. Includes the full list of 24 crashing DCS bytes and the fix.

modemmanager / cellular / dos / assertion / linux / vulnerability-research / cve

8 min read

2026-09-02 11 min read

CVE-2026-92162: Arch Path Traversal in the Flatpak System Helper

Technical breakdown of CVE-2026-92162 (GHSA-v2gw-v9h5-9q4x), a path traversal in the Flatpak system helper where an unvalidated arch string lets an active local user make the root helper create directories anywhere on disk, and how it chains into a full root file write.

flatpak / path-traversal / privilege-escalation / dbus / linux / cve

11 min read

2026-08-05 9 min read

CVE-2026-18649: Unbounded Memory Growth in GStreamer's RTP Depayloaders

A technical breakdown of a remote, unauthenticated denial of service in GStreamer's H.264 and H.265 RTP depayloaders, where FU-A fragment reassembly had no size limit.

gstreamer / rtp / dos / memory-safety / cve

9 min read