jankesec CVE Research

Calibrating a Root-Namespace Load Detector

Sun, 30 Aug 2026 18:30:00 GMT

I ended a CVE-2025-32463 write-up with a recommendation and never carried it out. This is what happened when I built the instrument to do it: an inert marker running as root, two detection layers that had to be redesigned mid-flight, and three ways the measurement lies to you.

Read the full casefile on jankesec

CVE-2024-0044: How Installer Metadata Forged an Android App Identity

Wed, 26 Aug 2026 22:15:00 GMT

A reader-first variant analysis of Android CVE-2024-0044: how a crafted installer name could corrupt packages.list, mislead run-as, and why the first fix needed a follow-up.

Read the full casefile on jankesec

CVE-2025-31205: How a Detached Stylesheet Exposed Cross-Origin Data

Mon, 24 Aug 2026 11:00:00 GMT

A reader-first analysis of CVE-2025-31205: how JavaScript kept a cross-origin stylesheet alive after detachment, why WebKit treated missing ownership as permission, and how the fix fails closed.

Read the full casefile on jankesec

CVE-2025-32463: How a User-Controlled Chroot Loaded Code as Root

Sun, 23 Aug 2026 09:00:00 GMT

A reader-first root-cause analysis of CVE-2025-32463: how sudo entered an attacker-controlled filesystem before authorization completed, why NSS could then load a library as root, and what 1.9.17p1 changed.

Read the full casefile on jankesec

CVE-2025-24201: How Web Content Reached an Unneeded GPU State

Sun, 23 Aug 2026 00:00:00 GMT

A reader-first reconstruction of Apple's CVE-2025-24201 WebKit fix: what the sandbox-escape advisory says, what primitive restart means, and what the public patch proves without inventing the private exploit chain.

Read the full casefile on jankesec

CVE-2024-4577: How Windows Reopened PHP-CGI Command Injection

Thu, 19 Feb 2026 08:00:00 GMT

A reader-first variant analysis of CVE-2024-4577 and CVE-2024-8926: how Windows character conversion turned safe-looking query input into PHP-CGI options and why the first fix needed a follow-up.

Read the full casefile on jankesec

CVE-2024-6387: How an OpenSSH Timeout Could Lead to Remote Root Access

Thu, 18 Sep 2025 08:00:00 GMT

A clear reconstruction of regreSSHion: how an unauthenticated connection triggered unsafe signal-time logging in sshd, why that could corrupt the heap, which systems were exposed, and how OpenSSH 9.8p1 fixed the root cause.

Read the full casefile on jankesec

CVE-2024-3094: How a Backdoored XZ Release Reached OpenSSH

Thu, 27 Mar 2025 08:00:00 GMT

A clear reconstruction of the XZ Utils supply-chain attack: what was changed, how malicious release tarballs altered liblzma, why selected OpenSSH servers became reachable, and which systems were actually exposed.

Read the full casefile on jankesec