R3n3r0
Source-scoped identity with 3 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
GitHubR3n3r0/CVE-2026-0049
Repository PoCStars: 0Created 2026-08-07ExploitCVE-2026-004915 files
Analysis
Technical assessment
The artifact is a full exploit kit for CVE-2026-0049, an integer overflow vulnerability in Android's DNG SDK. It includes multiple Python scripts to generate malicious DNG files that trigger the overflow, a C harness to execute the crash on-device via the Android ImageDecoder API, and pre-built sample DNG files. The primary purpose is to cause a denial-of-service crash (SIGABRT) by exploiting the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept for CVE-2026-0049, an integer overflow in Android's DNG decoder. All reviewed scripts and source code are consistent with generating or triggering the described denial-of-service vulnerability. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed.
Classification basis and observed behavior
Classification basis
The artifact contains multiple Python scripts (make_poc_dng.py, inject_opcode.py, make_dng.py) whose primary function is to construct a malicious DNG file that triggers the CVE-2026-0049 vulnerability. It also includes a C harness (decode_poc.c) to execute the crash on a device. The README explicitly describes this as a 'PoC' and provides reproduction steps to cause a crash. This is code intended to exercise a vulnerability, which meets the definition of an exploit.
README.md:1README.md:45-67poc/make_poc_dng.py:1-5harness/decode_poc.c:1-4Requirements
- A target Android device with a vulnerable version of libdng_sdk.so (Android 14, 15, or 16) compiled with Integer Sanitizer.
README.md:8-9 - The malicious DNG file must be placed in a location scanned by the Android media scanner or opened by an app that decodes DNG images.
README.md:25-26
Observed behavior
- Generates a malicious DNG file containing an OpcodeList2 with a MapTable opcode where Plane and Planes fields are set to cause an unsigned integer overflow (0xFFFFFF00 + 0x00000200).
poc/make_poc_dng.py:46-76poc/inject_opcode.py:14-20 - When the malicious DNG is decoded by the Android system, the integer overflow triggers an abort in the Integer Sanitizer, causing a SIGABRT crash in the decoding process.
README.md:6-9harness/decode_poc.c:1-4 - Provides a native C harness (decode_poc.c) that uses the Android AImageDecoder API to trigger the crash on a device, demonstrating the exploit path.
harness/decode_poc.c:1-46
Behaviors behind the backdoor verdict
Observables
- Vulnerability Trigger
- Payload withheldThese values cause an unsigned integer overflow in dng_opcode_MapTable::ProcessArea, leading to a SIGABRT when compiled with integer sanitizers.
poc/inject_opcode.py:23poc/make_dng.py:101poc/make_poc_dng.py:56 - Exploit Mechanism
- Payload withheldThe PoC scripts construct or modify DNG files to include the crafted opcode, which is the documented method to trigger the vulnerability.
poc/inject_opcode.py:4-10poc/make_poc_dng.py:4-27 - Test Harness
- Payload withheldThe harness is a straightforward C program that decodes a DNG file using the Android image decoder API, matching the documented crash path.
harness/decode_poc.c:1-46
What the analysis did not establish
- Three binary DNG sample files (valid_poc.dng, base_benign.dng, poc_minimal.dng) were not analyzed; their content is only known from metadata and surrounding documentation.
- Six text files (BLOG.md, BLOG.en.md, evidence/crash_backtrace.txt, evidence/device_analysis.md, poc/make_poc_dng.py, harness/dng_xmp_stub.cpp) were not included in the evidence packet, limiting full context.
- The analysis is based solely on the provided source code and documentation; the exploit was not executed or verified.
- Three binary DNG sample files (samples/base_benign.dng, samples/poc_minimal.dng, samples/valid_poc.dng) were not analyzed for embedded payloads beyond the documented opcode injection.
- Six text files (BLOG.md, BLOG.en.md, evidence/crash_backtrace.txt, evidence/device_analysis.md, harness/dng_xmp_stub.cpp, and one other) were omitted from the packet and not reviewed.
- The review is limited to static analysis of the provided source code; no dynamic execution or binary analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubR3n3r0/cve-2025-5915
Repository PoCStars: 0Created 2026-07-30ExploitCVE-2025-591555 files
Analysis
Technical assessment
The artifact is a comprehensive exploit for payload withheld, a heap buffer over-read in libarchive's RAR v4 filter path. It includes a from-scratch RAR v4 encoder (build_encoder.py) that crafts archives to trigger the vulnerability, a script to modify existing archives (build_bigleak.py), a macOS interpose library (plant.c) to demonstrate memory disclosure, and an iOS application (RARLeak) that uses the system's vulnerable libarchive to exfiltrate heap memory on a real device. The primary operation is exercising the vulnerability to achieve controlled memory disclosure.
Backdoor review
No backdoor observed in reviewed code
The repository is a proof-of-concept (PoC) for payload withheld, a heap buffer over-read in libarchive. The supplied text files (README.md, writeup/payload withheld.en.md, writeup/payload withheld.it.md) describe the vulnerability, the methodology for reproducing it, and the analysis of the fix. They contain no instructions or code that would perform backdoor or deceptive actions against the person running the PoC. The described behavior (crafting RAR archives to trigger an over-read, using an iOS app to demonstrate the leak) is consistent with the stated goal of demonstrating the CVE. The binary files (RAR archives, compiled output, iOS project) are flagged as uninspected, but the text documentation provides no indication of concealed malicious payloads.
Classification basis and observed behavior
Classification basis
The artifact contains multiple components that actively exercise the vulnerability to cause a heap over-read and exfiltrate memory, which is the definition of an exploit. The build_encoder.py script generates a malicious RAR archive from scratch to trigger the bug. The plant.c code and RARLeak iOS app are designed to demonstrate and measure the resulting memory disclosure. The writeup files are extensive technical analysis, but the presence of functional exploit code (the encoder, the interpose library, the iOS app) makes the primary classification 'exploit'.
README.md:3-6README.md:35-37writeup/cve-2025-5915.en.md:260-262writeup/cve-2025-5915.en.md:434-439Requirements
- A vulnerable version of libarchive (<= 3.7.9) must be used to process the crafted RAR archive.
README.md:3-6writeup/cve-2025-5915.en.md:29-30 - The attacker must be able to supply a crafted RAR v4 archive to the vulnerable libarchive instance.
README.md:44-50
Observed behavior
- Crafts a RAR v4 archive with a small declared uncompressed size (e.g., 16 bytes) to force a tiny LZSS window (32 bytes) and a large filter blocklength (e.g., 0x3C000) to trigger a heap over-read of up to ~240 KB.
writeup/cve-2025-5915.en.md:260-277 - Demonstrates that the out-of-bounds bytes read from the heap are included in the decompressed output, achieving memory disclosure.
writeup/cve-2025-5915.en.md:223-254 - On iOS 18.5, the provided app (RARLeak) dlopens the system libarchive, feeds it a crafted archive, and recovers ~150 KB of its own heap markers in the output, proving the vulnerability on a real device.
writeup/cve-2025-5915.en.md:434-449
Behaviors behind the backdoor verdict
Observables
- Vulnerability
- Payload withheldThe entire repository is a PoC for this libarchive heap over-read vulnerability.
README.md:1 - File
- Payload withheldPython script to generate a malicious RAR v4 archive that triggers the over-read. This is the core of the PoC and is expected behavior.
README.md:36 - File
- Payload withheldAn iOS Xcode project that demonstrates the vulnerability on a real device by using the system's libarchive. This is part of the documented PoC.
README.md:39
What the analysis did not establish
- The evidence packet includes 12 binary files (RAR archives, a binary payload) that were not analyzed; their content is only known from metadata and the writeup's description.
- The analysis is based solely on the provided text files (README.md, writeup files); the actual exploit code (Python, C, Objective-C) is not included in the text evidence, so its exact implementation cannot be verified from the supplied lines.
- The classification relies on the writeup's claims about the behavior of the code, as the code itself was not executed or inspected beyond the text descriptions.
- 12 binary files (RAR archives, compiled output, iOS project) were not analyzed and are flagged as BINARY. Their contents could not be reviewed for backdoors.
- 40 other text files in the repository were omitted from the evidence packet and were not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubR3n3r0/CVE-2026-20700
Repository PoCStars: 10Created 2026-05-23ExploitCVE-2026-2070011 files
Analysis
Technical assessment
The artifact is a proof-of-concept exploit for CVE-2026-20700 that demonstrates using dyld's chained fixup mechanism as a PAC signing oracle on arm64e iOS. It includes a hand-crafted Mach-O dylib generator, a launcher that loads it to trigger dyld to write PAC-valid function pointers into attacker-chosen slots, and a dispatch event loop demonstration that calls the written pointer without direct invocation.
Backdoor review
No backdoor observed in reviewed code
The repository is a proof-of-concept for CVE-2026-20700, demonstrating dyld chained fixup manipulation to produce PAC-valid pointers. All code serves this research purpose: generating a malformed Mach-O dylib, loading it, and verifying that dyld writes a controlled pointer. No concealed executable behavior, credential theft, persistence, or unrelated payloads were found. The dispatch timer demo is a natural extension of the PoC to show the pointer is callable through the event loop, not a backdoor.
Classification basis and observed behavior
Classification basis
The artifact contains code that actively exercises a vulnerability to achieve a controlled write of a PAC-valid pointer and then executes that pointer, which constitutes exploitation. The README explicitly states it demonstrates a 'write-what-where' primitive and 'dispatch event loop execution' of the written pointer.
README.md:13-15src/launcher.c:189-194Requirements
- Ability to load a hand-crafted Mach-O dylib on the target iOS device (e.g., via sideloading or developer certificate).
README.md:59 - Target device must be arm64e (e.g., iPhone 14) running a vulnerable iOS version (< 26.3).
README.md:7
Observed behavior
- Generates a malformed Mach-O dylib with a crafted chained fixup chain that instructs dyld to write a PAC-valid function pointer into a controlled location in the dylib's __DATA segment.
generators/gen_malformed_dylib.py:311-316 - The launcher loads the malformed dylib, causing dyld to process the fixup chain and overwrite a canary-protected slot with the address of a known exported function.
src/launcher.c:108-116 - The launcher reads the overwritten slot, validates canaries, and directly calls the function pointer written by dyld, confirming the write-what-where primitive.
src/launcher.c:189-194 - In 'chain_close' mode, the launcher registers the dyld-written pointer as a dispatch_source timer handler, causing the event loop to call it naturally without direct invocation from the PoC code.
src/launcher.c:344-372 - A second thread with a small stack triggers a dyld page-in linking gate stress test by loading a dylib with ~99k imported symbols, aiming for a deterministic crash.
src/launcher.c:275-308
Behaviors behind the backdoor verdict
Observables
- Poc Behavior
- Payload withheldCore demonstration of CVE-2026-20700: dyld as a PAC signing oracle
generators/gen_malformed_dylib.py:1-935src/launcher.c:80-241 - Poc Behavior
- Payload withheldDemonstrates that the PAC-valid pointer is callable without direct invocation, part of the 'chain close' concept
src/launcher.c:339-377 - Poc Behavior
- Payload withheldExplores the vulnerability's reachability and crash conditions
generators/gen_client.py:1-112src/launcher.c:246-308
What the analysis did not establish
- The evidence does not include the generated binary dylibs or the compiled PoCApp.ipa; only source code and build scripts are provided.
- The artifact's own documentation states the write primitive is limited to the dylib's own __DATA segment and requires a first-stage exploit to target system dylib GOT entries.
- The evidence packet reports complete_artifact_coverage is false, indicating some files (4 unclassified files) were not included in the analysis.
- 4 files (Makefile, blog/it/dyld-signing-oracle.md, blog/en/dyld-signing-oracle.md, and one unlisted file) were omitted from the text evidence; their content was not reviewed.
- The review is based solely on static source code analysis; no dynamic execution or binary analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.