Vlatko Kosturjak

9 exploits Active since Nov 2025
CVE-2025-63744 WRITEUP MEDIUM WRITEUP
radare2 < 6.0.5 - NULL Pointer Dereference in bin_dyldcache load() Function
A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Processing a crafted file can cause a segmentation fault and crash the program.
CVSS 4.3
CVE-2025-63745 WRITEUP MEDIUM WRITEUP
radare2 < 6.0.5 - Denial of Service via NULL Pointer Dereference in bin_ne.c info()
A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. A crafted binary input can trigger a segmentation fault, leading to a denial of service when the tool processes malformed data.
CVSS 5.5
CVE-2025-34449 WRITEUP CRITICAL WRITEUP
Genymobile scrcpy <= 3.3.3 - Buffer Overflow in sc_device_msg_deserialize()
Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() function. A compromised device can send crafted messages that cause out-of-bounds reads, which may result in memory corruption or a denial-of-service condition. This vulnerability may allow further exploitation on the host system.
CVSS 9.1
CVE-2025-34450 WRITEUP HIGH WRITEUP
merbanan/rtl_433 <= 25.02 - Stack-based Buffer Overflow in parse_rfraw()
merbanan/rtl_433 versions up to and including 25.02 and prior to commit 25e47f8 contain a stack-based buffer overflow vulnerability in the function parse_rfraw() located in src/rfraw.c. When processing crafted or excessively large raw RF input data, the application may write beyond the bounds of a stack buffer, resulting in memory corruption or a crash. This vulnerability can be exploited to cause a denial of service and, under certain conditions, may be leveraged for further exploitation depending on the execution environment and available mitigations.
CVSS 7.8
CVE-2025-34451 WRITEUP HIGH WRITEUP
proxychains-ng <= 4.17 - Stack-based Buffer Overflow in proxy_from_string()
rofl0r/proxychains-ng versions up to and including 4.17 and prior to commit cc005b7 contain a stack-based buffer overflow vulnerability in the function proxy_from_string() located in src/libproxychains.c. When parsing crafted proxy configuration entries containing overly long username or password fields, the application may write beyond the bounds of fixed-size stack buffers, leading to memory corruption or crashes. This vulnerability may allow denial of service and, under certain conditions, could be leveraged for further exploitation depending on the execution environment and applied mitigations.
CVSS 7.8
CVE-2025-34457 WRITEUP HIGH WRITEUP
wb2osz/direwolf <1.8 - Buffer Overflow
wb2osz/direwolf (Dire Wolf) versions up to and including 1.8, prior to commit 694c954, contain a stack-based buffer overflow vulnerability in the function kiss_rec_byte() located in src/kiss_frame.c. When processing crafted KISS frames that reach the maximum allowed frame length (MAX_KISS_LEN), the function appends a terminating FEND byte without reserving sufficient space in the stack buffer. This results in an out-of-bounds write followed by an out-of-bounds read during the subsequent call to kiss_unwrap(), leading to stack memory corruption or application crashes. This vulnerability may allow remote unauthenticated attackers to trigger a denial-of-service condition.
CVE-2025-34458 WRITEUP HIGH WRITEUP
wb2osz/direwolf <1.8 - Assertion Failure
wb2osz/direwolf (Dire Wolf) versions up to and including 1.8, prior to commit 3658a87, contain a reachable assertion vulnerability in the APRS MIC-E decoder function aprs_mic_e() located in src/decode_aprs.c. When processing a specially crafted AX.25 frame containing a MIC-E message with an empty or truncated comment field, the application triggers an unhandled assertion checking for a non-empty comment. This assertion failure causes immediate process termination, allowing a remote, unauthenticated attacker to cause a denial of service by sending malformed APRS traffic.
CVE-2025-63744 WRITEUP MEDIUM WRITEUP
radare2 < 6.0.5 - NULL Pointer Dereference in bin_dyldcache load() Function
A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Processing a crafted file can cause a segmentation fault and crash the program.
CVSS 4.3
CVE-2025-63745 WRITEUP MEDIUM WRITEUP
radare2 < 6.0.5 - Denial of Service via NULL Pointer Dereference in bin_ne.c info()
A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. A crafted binary input can trigger a segmentation fault, leading to a denial of service when the tool processes malformed data.
CVSS 5.5