kagancapar
Source-scoped identity with 4 associated PoCs and 4 linked vulnerabilities.
Exploit catalog results
Showing 4 PoCs on this page
GitHubkagancapar/CVE-2026-54984
Repository PoCStars: 0Created 2026-08-12WriteupCVE-2026-549842 files
Analysis
Technical assessment
A public disclosure record for CVE-2026-54984, a heap-based buffer overflow in Windows ICC file parsing. The repository contains no proof-of-concept code or technical analysis, only advisory identifiers, scoring, affected builds, patch KBs, and a timeline assembled from vendor and ZDI advisories.
Backdoor review
No backdoor observed in reviewed code
The repository contains only two Markdown files (English and Turkish) that document the CVE-2026-54984 vulnerability disclosure. The README explicitly states it contains no proof of concept or technical analysis. No executable code, scripts, shellcode, or commands are present. The content is purely informational, summarizing public advisories, affected products, and a timeline.
Classification basis and observed behavior
Classification basis
The artifact is a writeup because it provides substantive technical analysis of CVE-2026-54984, including vulnerability description, attack characteristics, affected products, and a disclosure timeline, without containing any exploit or scanner code. The author explicitly states the repository contains no PoC or technical analysis, but the assembled advisory information constitutes a writeup.
README.md:8README.md:28-44README.md:46-61Requirements
- User interaction is required; the target must open or process attacker-supplied content (e.g., a malicious ICC color profile).
README.md:55
Observed behavior
- The artifact describes the vulnerability as a heap-based buffer overflow in Mscms.dll during ICC profile parsing, allowing an out-of-bounds write that can lead to arbitrary code execution in the context of the current process.
README.md:32README.md:36 - The artifact provides a table of affected Windows versions and their fixed build numbers, along with corresponding KB articles.
README.md:67-82 - The artifact explicitly states it contains no proof of concept and no technical analysis.
README.md:8
Behaviors behind the backdoor verdict
Observables
- Disclosure
- Payload withheldConfirms the artifact is a documentation-only repository with no executable exploit code.
README.md:8
What the analysis did not establish
- The artifact contains no executable code, no proof-of-concept, and no original technical analysis beyond what is stated in the vendor and ZDI advisories. The author notes that ZDI acquisition terms grant exclusivity over technical detail.
- Review is limited to the two text files provided; no other files exist in the repository snapshot.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubkagancapar/CVE-2021-47881
Repository PoCStars: 0Created 2026-08-10WriteupCVE-2021-478816 files
Analysis
Technical assessment
The artifact is a detailed technical writeup and archival record for CVE-2021-47881, a local stack-based buffer overflow in dataSIMS Avionics ARINC 4.5.3. It includes an annotated payload breakdown, a disassembly of an inert decoder stub, an honest exploitability assessment, and corrections to the published CVE record. The repository references a published PoC but the provided text files are explanatory documentation, not executable exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The repository contains documentation and a PoC for CVE-2021-47881, a local buffer overflow in dataSIMS Avionics ARINC 4.5.3. The reviewed text files (README.md, en/CVE-2021-47881-ENG.md, tr/CVE-2021-47881-TR.md) describe the vulnerability, payload layout, and an inert decoder stub. No backdoor, concealed harmful behavior, or deceptive payload targeting the reviewer is present. The PoC is explicitly a control-of-EIP demonstration that does not achieve code execution.
Classification basis and observed behavior
Classification basis
The provided files are Markdown documents (README.md, en/CVE-2021-47881-ENG.md, tr/CVE-2021-47881-TR.md) that contain a technical analysis, payload anatomy, exploitability assessment, and CVE record corrections. They do not contain executable exploit or scanner code; they are a substantive writeup. The repository may contain PoC code in other files, but those files were not included in the evidence packet.
README.md:1-169en/CVE-2021-47881-ENG.md:1-177Requirements
- Requires the target software dataSIMS Avionics ARINC 4.5.3 to be installed and the operator to load the crafted milstd1553result.txt file.
README.md:28README.md:116
Observed behavior
- The writeup describes how a crafted milstd1553result.txt file overflows a stack buffer, overwriting the saved return address and gaining control of EIP, demonstrated by a crash with EIP=0x42424242.
README.md:28-34en/CVE-2021-47881-ENG.md:26-34 - The writeup analyzes the payload layout, identifying the EIP overwrite at offset 1007 and explaining that the included shikata_ga_nai decoder stub is inert and cannot execute.
README.md:40-79en/CVE-2021-47881-ENG.md:36-86
Behaviors behind the backdoor verdict
Observables
- Vulnerability Disclosure
- Payload withheldThe artifact is a vulnerability disclosure repository, not a backdoor. The PoC overwrites EIP with 0x42424242 and includes an inert msfvenom shikata_ga_nai stub that cannot execute.
README.md:28-36README.md:55-79 - Inert Payload
- Payload withheldThe stub is explicitly described as inert and non-functional; it cannot execute and serves as padding. This is consistent with a PoC that demonstrates control of EIP without achieving code execution.
README.md:55-79en/CVE-2021-47881-ENG.md:62-86
What the analysis did not establish
- Evidence packet includes only three Markdown files (README.md, en/CVE-2021-47881-ENG.md, tr/CVE-2021-47881-TR.md). The repository contains 6 files total; the PoC scripts (e.g., poc/49577.py, poc/poc_py3.py) are referenced but not included in the packet, so their content cannot be analyzed.
- complete_artifact_coverage is false; the analysis is limited to the selected text files provided.
- Only three text files (README.md, en/CVE-2021-47881-ENG.md, tr/CVE-2021-47881-TR.md) were reviewed; three additional text files and three unclassified files were omitted from the packet.
- The actual PoC scripts (poc/49577.py, poc/poc_py3.py) were not included in the reviewed text; only their described behavior was analyzed.
- Binary content, if any, was not inspected per the evidence envelope's binary policy.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubkagancapar/CVE-2026-5201
Repository PoCStars: 13Created 2026-04-01ExploitCVE-2026-520115 files
Analysis
Technical assessment
The artifact contains a Python script that generates a crafted JPEG file designed to trigger a heap-based buffer overflow in gdk-pixbuf's JPEG loader. It also includes a C program to load the crafted file and trigger the crash, along with detailed analysis of exploitation primitives including vtable hijack and code execution on 32-bit systems.
Backdoor review
No backdoor observed in reviewed code
The repository contains documentation and a Python reproducer for CVE-2026-5201, a heap-based buffer overflow in gdk-pixbuf. The Python script (reproducer/craft_cve_2026_5201.py) constructs a malformed JPEG to trigger the vulnerability. No backdoor, concealed executable, or operator-directed harm is present. The script's behavior is limited to generating a proof-of-concept JPEG file; it does not execute any payload, establish persistence, or exfiltrate data.
Classification basis and observed behavior
Classification basis
The artifact includes a Python script that crafts a malicious JPEG file specifically designed to trigger a heap buffer overflow vulnerability (CVE-2026-5201) and a C program to load it and cause a crash. The writeup details exploitation steps including vtable hijack and code execution. This constitutes an exploit as it provides code intended to exercise the vulnerability.
reproducer/craft_cve_2026_5201.py:1-132en/CVE-2026-5201-ENG.md:221-276en/CVE-2026-5201-ENG.md:382-402Requirements
- A system with a vulnerable version of gdk-pixbuf installed.
en/CVE-2026-5201-ENG.md:127-130 - The ability to compile and run the provided C crash test program or use Python bindings to load the crafted JPEG.
en/CVE-2026-5201-ENG.md:264-276
Observed behavior
- The Python script 'craft_cve_2026_5201.py' generates a 122-byte JPEG file with 9 color components declared in the SOF10 header but only 3 scanned in the SOS header.
reproducer/craft_cve_2026_5201.py:22-97 - The C program 'crash_test.c' loads the crafted JPEG using gdk_pixbuf_new_from_file(), which triggers a heap buffer overflow in the JPEG loader, leading to a segmentation fault.
en/CVE-2026-5201-ENG.md:264-276 - The writeup describes how the heap overflow corrupts adjacent GObject structures, overwriting vtable pointers with attacker-controlled pixel data, and demonstrates code execution on 32-bit Linux via vtable hijack.
en/CVE-2026-5201-ENG.md:384-402
Behaviors behind the backdoor verdict
Observables
- File Creation
- Payload withheldThe script generates a 122-byte JPEG with 9 components in SOF10 and 3 in SOS to demonstrate the buffer overflow. It does not execute the file or perform any network activity.
reproducer/craft_cve_2026_5201.py:111-112 - Author Contact
- Payload withheldContact information is provided in documentation for credit and reporting purposes. It is not used to deliver a payload or command.
README.md:150
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are included. The analysis is based on the four provided text files.
- The evidence includes non-text media files (1 file, 122 bytes) and unclassified files (10 files, 36355 bytes) that were not analyzed.
- The provided C code for crash_test.c is embedded within the markdown writeup; the actual source file is not provided as a separate file in the evidence.
- 11 files omitted from the repository (10 unclassified, 1 non-text media) were not analyzed; their content is unknown.
- Binary files were flagged as metadata-only and not inspected for embedded payloads.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.