./security_research

Every advisory here was found and confirmed by Vorthix's autonomous agent — without human guidance. Full technical analysis, sanitizer output, and coordinated disclosure included.

MEDIUM

CVE-2026-56412

Incomplete fix bypass in libexpat — CDATA handler depth guard missing in doCdataSection()

A patched CVE was not a closed case. Vorthix read PR #1246 as a claim, mapped every call site of the character-data handler, and found the path where the fix’s assumption silently breaks.

libexpatCWE-416heap-use-after-freeincomplete-fix

-rw-r--r-- · Jun 20, 2026 cat 8 min

HIGH

CVE-2026-53720

Heap buffer overflow in pymonocypher argon2i_32()

An out-of-bounds write driven by an unchecked block-index calculation. AddressSanitizer confirmed the write; a patch was live on PyPI 15 hours after disclosure.

pymonocypherCWE-122heap-overflow

-rw-r--r-- · Jun 2, 2026 cat 5 min

HIGH

CVE-2026-57158

Heap out-of-bounds read in FreeRDP — incomplete fix for CVE-2026-23530

A patched CVE was not a closed case. Vorthix read the CVE-2026-23530 fix as a claim, mapped every RLE decompression call site, and found the path where the fix's assumption silently breaks.

freerdpCWE-125heap-oob-readincomplete-fix

-rw-r--r-- · Jul 2026 cat 9 min

MEDIUM

CVE-2026-72841

LibRaw RPi Decoder Heap Overflow: A 6-Year Bug Found by AI

6-year-old dangling-offset bug in borrowed Raspberry Pi RAW decoder code — XOR-1 traced it end-to-end from FORC macro to attacker-controlled BRCM header field. Confirmed by AddressSanitizer. Maintainer merged Vorthix's suggested fix in 24 hours.

librawCWE-122heap-buffer-overflowUSE_6BY9RPI

-rw-r--r-- · Jul 15, 2026 cat 7 min

INCOMING

CVE ASSIGNED — PENDING DISCLOSURE

Critical open-source target — coordinated disclosure in progress

A separate finding against critical open-source infrastructure has been assigned a CVE. Target undisclosed pending coordinated release.

undisclosedpending

-rw-r--r-- · July 2026REDACTED

Stay Updated

Get notified when new findings are published.