CVE-2026-111954: upload reader failed redirect UAF
HackerOnecurl2026-10-26
Binary
Low
BUG BOUNTY WRITEUPS
Memory corruption writeups
Buffer overflows, use-after-free and integer bugs in C and C++ projects like curl, browsers and native libraries.
162 reports and writeups from 2024 to 2026. 96 carry a severity from the disclosing platform, 43 of them rated High or Critical. Last updated 2026-10-30.
Latest Memory corruption reports
Search and filter all writeupsCVE-2026-111952: OpenSSL provider use-after-free again
HackerOnecurl2026-10-26
Binary
Medium
CVE-2026-111480: pause UAF from within callback
HackerOnecurl2026-10-26
Binary
Low
CVE-2026-111878: OpenSSL provider UAF on TLS shutdown
HackerOnecurl2026-10-26
Binary
Low
OpenSSL provider OSSL_LIB_CTX used after free via the connection shutdown list (CVE-2026-80229 fix incomplete)
HackerOnecurl2026-10-26
Binary
Low
PHP2Shell: When a Memory Bug Turns Into Remote Code Execution
Medium2026-10-25
Binary
Not rated
Heap-use-after-free in libcurl's multi event machinery (curl_multi_remove_handle() from a socket callback nested under a notify callback)
HackerOnecurl2026-10-23
Binary
Low
WebSocket send queue use-after-free during nested curl_ws_send()
HackerOnecurl2026-10-20
Binary
Low
WebSocket decoder use-after-free when curl_easy_pause() unpauses from a debug callback
HackerOnecurl2026-10-19
Binary
Not rated
libcurl TLS shorter-retry mismatch discloses client heap memory during cancelled IMAPS upload
HackerOnecurl2026-10-19
Binary
Medium
libcurl shared-HSTS-cache race leads to use-after-free with attacker-controlled function-pointer call
HackerOnecurl2026-10-19
Binary
Critical
[Switch] Remote stack buffer overflow in the LDN/LP2P DHCP server leads to control-flow hijack
HackerOneNintendo2026-10-15
Binary
High
CVE-2026-92392: HTTP/2 upload Use-After-Free
HackerOnecurl2026-10-14
Binary
High
Retry-independent time-condition HTTP/2 UAF
HackerOnecurl2026-10-14
Binary
Not rated
Connector/ODBC: malicious server's long version string wraps size_t PrefixLen via negative _snprintf return, causing heap out-of-bounds write
HackerOneMariaDB2026-10-12
Binary
Medium
Connector/C++: heap out-of-bounds read when malicious server field length exceeds declared column length in binary result path
HackerOneMariaDB2026-10-12
Binary
Medium
Stack Buffer Overflow in MariaDB CONNECT storage engine when reading DOUBLE columns from TABLE_TYPE=DOS tables
HackerOneMariaDB2026-10-12
Binary
Not rated
Pre-authentication `size_t` integer underflow → out-of-bounds read / server crash in MariaDB `caching_sha2_password` (auth_mysql_sha2) via an RSA-OAEP
HackerOneMariaDB2026-10-07
Web
Medium
Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read
HackerOneMariaDB2026-10-07
Binary
Critical
Heap Use-After-Free in Materialized_cursor::open via SYS_REFCURSOR Array Reallocation
HackerOneMariaDB2026-10-07
Binary
High
Rustls backend discloses out-of-bounds heap data during legal IMAP upload cancellation
HackerOnecurl2026-10-05
Binary
Medium
Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` heade
HackerOnecurl2026-10-05
Binary
High
Connector/C Out-of-bounds read in `unpack_fields()` from short metadata field
HackerOneMariaDB2026-09-30
Web
Not rated
CVE-2024-0244 – A heap buffer overflow in the Canon MF753Cdw printer
Researcher blog2026-09-23
Binary
Not rated
Use-after-free of the internal multi->admin easy handle via the documented CURLMOPT_NOTIFYFUNCTION callback
HackerOnecurl2026-09-19
Binary
Medium
Stack Buffer Overflow via Crafted keyseg->start/ keyseg->length in .MYI File (MariaDB MyISAM)
HackerOneMariaDB2026-09-15
Binary
Not rated
Out-of-bounds read in curl_formadd when CURLFORM_NAMELENGTH is explicitly 0
HackerOnecurl2026-09-15
Web
Not rated
Heap-use-after-free in CURLOPT_REFERER when passed a CURLINFO_REFERER pointer
HackerOnecurl2026-09-14
Binary
Low
Use-After-Free in BTREE Index Traversal via Stale key_version in heap_update() in MariaDB Server
HackerOneMariaDB2026-09-14
Binary
Not rated
55: Heap-buffer-overflow read in `curl_formadd_ccsid()` with binary form data
HackerOnecurl2026-09-10
Binary
Not rated
Conflux-queued zero-length RELAY_END triggers heap out-of-bounds read
HackerOneTor2026-09-10
Binary
Medium
Stack Buffer Overflow in mariadb-dump quote_name() Allows Malicious Server to Execute Arbitrary Code on Client
HackerOneMariaDB2026-09-08
Binary
Critical
Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking
HackerOneMariaDB2026-09-08
Web
High
57: Heap out-of-bounds read in `curl_easy_escape_ccsid()` / `curl_easy_unescape_ccsid()`
HackerOnecurl2026-09-07
Binary
Not rated
MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion
HackerOneMariaDB2026-09-07
Binary
Medium
54: Rejected HTTP/2 push destroys MIME callback state still used by parent (use-after-free)
HackerOnecurl2026-09-07
Binary
Not rated
Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app
HackerOneNextcloud2026-09-05
Web, Cloud
Low
CVE-2026-80229: OpenSSL provider use-after-free
HackerOnecurl2026-09-03
Binary
Not rated
CVE-2026-18924: HTTP/2 server push UAF
HackerOnecurl2026-09-02
Binary
Low
Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2
HackerOneNode.js2026-08-28
Binary
High
Heap use-after-free (write) in mev_forget_socket() via reentrant curl_easy_pause() — incomplete fix for CVE-2026-9080
HackerOnecurl2026-08-04
Binary
Medium
CURLSHOPT_UNSHARE race can cause UAF in shared SSL session cache during HTTPS transfer
HackerOnecurl2026-06-30
Binary
Not rated
heap-use-after-free in curl_easy_cleanup() called from callback
HackerOnecurl2026-06-30
Binary
Not rated
UAF read in mev_pollset_diff() trace path after curl_easy_pause() in socket callback
HackerOnecurl2026-06-28
Binary
Low
Use-after-free in `mev_forget_socket` when `curl_easy_pause()` is called from a `CURL_POLL_REMOVE` socket callback (incomplete fix of CVE-2026-9080)
HackerOnecurl2026-06-28
Binary
Low
Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)
HackerOneNode.js2026-06-25
Web
High
CVE-2026-9546: sending old referer
HackerOnecurl2026-06-24
Binary
Low
CVE-2026-9080: UAF after pause in socket callback
HackerOnecurl2026-06-24
Binary
Low
Vulnerability Report: Buffer Overflow in Path Sanitization
HackerOnecurl2026-06-16
Binary
Critical
Firecracker Out-of-bounds Read/Write Local Privilege Escalation Vulnerability
HackerOneAWS VDP2026-06-11
Web, Cloud
Not rated
heap-use-after-free in state.referer when CURLOPT_REFERER replaced or cleared after perform
HackerOnecurl2026-06-11
Binary
Low
Use-after-free in `curl_easy_duphandle()` with HTTP/2 stream-dependency tree
HackerOnecurl2026-06-01
Source Code, Binary
Not rated
Memory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`)
HackerOneNode.js2026-05-23
Binary
High
CURLOPT_HSTS_CTRL disables shared HSTS without share guard — use-after-free and double-free
HackerOnecurl2026-05-18
Binary
Not rated
Heap-buffer-overflow in `Curl_ssl_push_certinfo_len()` — sole bounds check is `DEBUGASSERT`
HackerOnecurl2026-04-29
Binary
High
Use-after-free in `curl_easy_ssls_export()` during callback re-entrancy
HackerOnecurl2026-04-29
Binary
High
Use-After-Free in SMB connection reuse (req->path dangling pointer after needle destruction)
HackerOnecurl2026-04-29
Binary
High
Integer Overflow/Signedness Mismatch in Printf Precision for HTTP/2 Trailer Headers
HackerOnecurl2026-04-11
Web
Not rated
Reported RPC Overflow
HackerOneMonero2026-04-06
Web3
Not rated
Use-After-Free race condition in url_move_hostname() via shared connection pool
HackerOnecurl2026-03-31
Binary
Medium
Function `do_pubkey()` can have out-of-bound read issue
HackerOnecurl2026-03-25
Web
Not rated
CVE-2026-3805: use after free in SMB connection reuse
HackerOnecurl2026-03-11
Binary
Medium
Use after free in hyperfifo example
HackerOnecurl2026-03-03
Binary
Not rated
Integer Overflow in curl_multi_get_handles() Leading to Heap Buffer Overflow
HackerOnecurl2026-02-26
Binary
Medium
Curl Telnet Handler Buffer Overflow
HackerOnecurl2026-02-26
Binary
Not rated
Cookie Max-Age Integer Overflow Vulnerability
HackerOnecurl2026-01-19
Web
Critical
Cookie Replacement Use-After-Free Vulnerability
HackerOnecurl2026-01-19
Binary
Not rated
Use-After-Free in curl_easy_nextheader when reusing header handle across requests
HackerOnecurl2026-01-14
Binary
Not rated
integer Overflow in MQTT Protocol Handling Allows Bypassing Message Size Limit
HackerOnecurl2026-01-13
Web
High
Heap Out-of-Bounds Read in lib/http2.c via Malformed PUSH_PROMISE Headers
HackerOnecurl2026-01-10
Binary
High
Stack Buffer Overflow in mprintf.c formatting function (fallback path)
HackerOnecurl2026-01-08
Binary
High
MQTT Protocol Violation & Integer Overflow in libcurl
HackerOnecurl2026-01-01
Web
High
Telnet Suboption Buffer Pointer Underflow in lib/telnet.c leads to Out-of-Bounds Read
HackerOnecurl2025-12-29
Web
Low
Security hardening: missing integer overflow check in curl_load_library()
HackerOnecurl2025-12-27
Web
Low
Integer Overflow in `curl_easy_escape()` may lead to heap buffer overflow and stack memory disclosure on 32-bit platforms
HackerOnecurl2025-12-25
Binary
Low
Heap Buffer Over-Read via Malicious SMB Server READ_ANDX Response
HackerOnecurl2025-12-25
Binary
Medium
Heap Buffer Over-Read via Malicious SMB Server READ_ANDX Response
HackerOnecurl2025-12-20
Binary
High
Heap buffer overflow in Curl_ipv4_resolve_r due to incorrect buffer alignment and size calculation on AmigaOS
HackerOnecurl2025-12-17
Binary
Not rated
Heap Overflow in cURL AmigaOS Socket Implementation
HackerOnecurl2025-12-16
Binary
Medium
Curl Alt-Svc Parser Stack Buffer Overflow
HackerOnecurl2025-12-16
Binary
Medium
Buffer Overflow in cURL Internal printf Function
HackerOnecurl2025-12-12
Binary
Critical
Stack Buffer Overflow in cURL wolfSSL Backend (lib/vtls/wolfssl.c)
HackerOnecurl2025-12-09
Binary
Not rated
Title: Use-After-Free in cURL Test Suite via Improper Cleanup of Global Handle
HackerOnecurl2025-12-05
Binary
High
Heap Buffer Overflow in TFTP
HackerOnecurl2025-12-01
Binary
Critical
Out-of-bounds read in HTTP method handling causes undefined behavior and potential crash This is sharp, Gaurav. We’ve got a real memory-safety bug ins
HackerOnecurl2025-11-20
Web
High
Off-by-One Buffer Overflow in SMB Path Handler
HackerOnecurl2025-11-15
Binary
Medium
Unsafe use of strcpy in Curl_ldap_err2string (packages/OS400/os400sys.c) — stack-buffer-overflow (PoC + ASan)
HackerOnecurl2025-11-10
Binary
Medium
libcurl MQTT `CURLOPT_POSTFIELDSIZE_LARGE` overflow leads to immediate DoS
HackerOnecurl2025-11-10
Web
Medium
SOCKS5 Heap Buffer Overflow via Malicious HTTP Redirect with Oversized Hostname
HackerOnecurl2025-10-31
Binary
Medium
libcurl MQTT PUBLISH length overflow (heap overflow)
HackerOnecurl2025-10-28
Binary
Low
Integer Overflow to Heap Overflow in DoH Response Handling
HackerOnecurl2025-10-25
Binary
Not rated
Buffer Overflow in WebSocket Handshake (lib/ws.c:1287)
HackerOnecurl2025-10-21
Binary
High
Use-after-free when POST body buffer is freed before transfer
HackerOnecurl2025-09-26
Binary
Medium
int overflow in krb5_read_data() leads to (possible) massive `recv()` write
HackerOnecurl2025-09-18
Web
Low
Security Analysis Report: CURL Integer Overflow Vulnerability
HackerOnecurl2025-09-18
Web
Not rated
Stack Buffer Overflow in cURL Cookie Parsing Leads to RCE
HackerOnecurl2025-09-16
Binary
High
Multiple Unsafe strcpy() Function Calls Leading to Potential Buffer Overflow Vulnerabilities in cURL 8.16.1-DEV
HackerOnecurl2025-09-14
Binary
High
CVE-2025-9086: Out of bounds read for cookie path
HackerOnecurl2025-09-10
Web
Low
Heap-buffer-overflow (Out-of-Bounds Read) in DoH hostname encoding
HackerOnecurl2025-09-04
Binary
Not rated
## Title Heap Use-After-Free Vulnerability in `curl` Leading to Potential Code Execution
HackerOnecurl2025-08-18
Binary
Medium
Heap Buffer Overflow in Curl_memdup0() via CURLOPT_COPYPOSTFIELDS/CURLOPT_POSTFIELDSIZE Mismatch
HackerOnecurl2025-08-09
Binary
High
Use After Free (that leads to arbitrary Write for some versions)
HackerOnecurl2025-08-06
Binary
Not rated
Integer Overflow in schannel.c TLS Data Transmission
HackerOnecurl2025-08-02
Web
Medium
Stack use-after-scope in HTTP/3 POST request processing via CURLOPT_POSTFIELDS
HackerOnecurl2025-07-31
Binary
High
OpenSSL HTTP/3 bogus CURLINFO_TLS_SSL_PTR
HackerOnecurl2025-07-28
Binary
Not rated
Use after free (or assert triggered) with failed allocations in openssl
HackerOnecurl2025-07-24
Binary
Not rated
My `Blind Date` with CVE-2025-29824
Researcher blog2025-07-16
Windows, Binary
Not rated
Use-After-Free in OpenSSL Keylog Callback via SSL_get_ex_data() in libcurl
HackerOnecurl2025-07-09
Binary
High
Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations
HackerOnecurl2025-07-07
Web
Medium
[MK8DX] Improper ranking/replay file parsing
HackerOneNintendo2025-07-06
Binary
Critical
Heap buffer overflow vulnerability in conncache.c: incorrect use of pointer arrays resulting in out-of-bounds memory writes.
HackerOnecurl2025-07-01
Binary
Medium
Buffer Overflow in curl's Rustls Backend
HackerOnecurl2025-06-30
Binary
Not rated
Stack-based Buffer Overflow in TELNET NEW_ENV Option Handling
HackerOnecurl2025-06-30
Binary
High
Heap Buffer Overflow in libcurl curl_slist_append via Unterminated String
HackerOnecurl2025-06-30
Binary
High
Free of uninitialized pointer in doh_decode_rdata_name()
HackerOnecurl2025-06-28
Binary
Not rated
Buffer Overflow in curl MQTT Test Server (tests/server/mqttd.c) via Malicious CONNECT Packet
HackerOnecurl2025-06-28
Binary
Critical
Stack Buffer Overflow in curl's OpenSSL Provider Handling
HackerOnecurl2025-06-28
Binary
Medium
[Xenoblade Chronicles X: Definitive Edition] Buffer overflow in string escape function, multiplayer DoS
HackerOneNintendo2025-05-15
Binary
High
Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo & args) when args[0] is a string.
HackerOneNode.js2025-05-15
Binary
Low
CVE-2025-0725: Heap overflow in curl with Content-Encoding gzip and old libz versions
HackerOneInternet Bug Bounty2025-04-27
Binary
Low
Heap‑based buffer overflow in curl -K allows arbitrary write .
HackerOnecurl2025-04-27
Binary
High
sys_fsc2h_ctrl kernel stack free
HackerOnePlayStation2025-04-18$10,000 bounty
Linux, Binary
High
Use after free (read) in curl_multi_perform with DoH and Proxy options, and resolve timeouts
HackerOnecurl2025-03-06
Binary
Not rated
("possible") UAF
HackerOnecurl2025-02-08
Binary
Not rated
CVE-2025-0725: gzip integer overflow
HackerOnecurl2025-02-05
Binary
Low
CVE-2024-26230: Windows Telephony Service - It's Got Some Call-ing Issues (Elevation of Privilege)
Researcher blog2025-01-24
Windows, Binary
Not rated
All I Want for Christmas is a CVE-2024-30085 Exploit
Researcher blog2024-12-24
Cloud, Windows, Binary
Not rated
Buffer Overflow Risk in Curl_inet_ntop and inet_ntop4
HackerOnecurl2024-12-08
Binary
High
Buffer Overflow Vulnerability in strcpy() Leading to Remote Code Execution
HackerOnecurl2024-12-02
Binary
Critical
Buffer overflow in strcpy
HackerOnecurl2024-11-07
Binary
Critical
Memory Leak in bytes_to_hexstring Function
HackerOneLinux Foundation Decentralized Trust2024-10-24
Linux, Binary
Low
[Switch, PIA/MK8DX] Stack buffer overflow and potential RCE in PIA (LAN/LDN, possibly NEX) room info deserialization
HackerOneNintendo2024-09-30
Binary
Medium
Ghost In The Ppl Part 1: Byovdll
Researcher blog2024-09-02
Binary
Not rated
4 exploits, 1 bug: exploiting cve-2024-20017 4 different ways
Researcher blogMediaTek2024-08-30
Binary
Not rated
CVE-2024-37079:
Researcher blogVMware2024-08-28
Binary
Not rated
libcurl: freeing stack buffer during x509 certificate parsing
HackerOneInternet Bug Bounty2024-08-23
Binary
Medium
Vulnerabilities in NodeJS C/C++ add-on extensions
Researcher blogNode.js third-party modules2024-08-14
Source Code, Binary
Not rated
SSD Advisory – Foscam R4M UDTMediaServer Buffer Overflow
Researcher blogFoscam2024-07-04
Source Code, Binary
Not rated
CVE-2024-29510 – Exploiting Ghostscript using format strings
Researcher blogGhostscript2024-07-02
Binary
Not rated
Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws
Researcher blogFactorio2024-06-29
Binary
Not rated
Preauth RCE on NVIDIA Triton Server
Researcher blogNvidia2024-06-19
AI, Binary
Not rated
Out-Of-Bounds Memory Read on ███
HackerOneU.S. Dept Of Defense2024-06-18
Web
Not rated
Iconv, Set The Charset To RCE: Exploiting The Glibc To Hack The PHP Engine (Part 2)
Researcher blogGNU C Library (glibc)2024-06-17
Binary
Not rated
Multiple vulnerabilities in Eclipse ThreadX
Researcher blogMicrosoft, Eclipse Foundation (Eclipse ThreadX)2024-05-28
Binary
Not rated
Iconv, Set The Charset To RCE: Exploiting The Glibc To Hack The PHP Engine (Part 1)
Researcher blogGNU C Library (glibc)2024-05-27
Binary
Not rated
Linguistic Lumberjack: Attacking Cloud Services via Logging Endpoints (Fluent Bit - CVE-2024-4323)
Researcher blogCloud Native Computing Foundation (Fluent Bit)2024-05-20
API, Cloud, Binary
Not rated
CVE-2024-21115: An Oracle Virtualbox LPE Used To Win Pwn2Own
Researcher blogOracle (VirtualBox)2024-05-09$20,000 bounty
Source Code, Binary
Not rated
Exploit Archeology - Exploiting an old unknown Server Side Browser
Researcher blog2024-05-08
Binary
Not rated
20 Security Issues Found in Xiaomi Devices
Researcher blogXiaomi2024-05-02
Android, Source Code, Binary
Not rated
CVE-2024-2887: A Pwn2Own Winning Bug In Google Chrome
Researcher blogGoogle (Chrome), Microsoft (Edge)2024-05-02
Binary
Not rated
Showing the 150 most recent of 162. See all in the searchable index.
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.