Tag: Security

2025 2026 Abliteration Agpl Ai Arp Assumed-Breach Benchmark Browser-Extension Comfyui Ctf Cve Cve-2025-49113 Docker Dragonflybsd Eval-Injection Flask Forensics Gemma Gemma-4-12b Gemma-4-E2b Gemma-4-E4b Glm Glm-4.7-Flash Gogs Hack-Smarter Hackthebox Hashicorp Hauhaucs Heretic Huggingface Jwt Kernel Kl-Divergence Llm Ltx-2 Memory-Disclosure Open-Source Pentest Plagiarism Privilege-Escalation Psreadline Qwen Qwen-3.6 Qwen-3.8 Qwen3-Vl Reaper-Abliteration Roundcube Security Smtp Uncensored-Llm Vault Video-Generation Vision-Language Windows
CVE-2026-110912: Arpbleed
security cve dragonflybsd arp kernel memory-disclosure glm 2026

CVE-2026-110912 is my first published CVE! The fix is merged upstream and the record is live in the database. It lives in a 23-year-old corner of DragonFly BSD. The ARP input path trusts two one-byte length fields from any packet on the wire. Ask for a 200-byte hardware address and the kernel builds its reply with a 200-byte memcpy out of a 6-byte buffer, and sends the excess back to you. Same trick on the protocol length reads straight off the kernel stack. One crafted ARP request on the same L2 segment leaks up to 249 bytes of heap and 251 bytes of stack, kernel pointers included. No authentication, and nothing in the victim’s logs.

October 15, 2026