Vulnerability research by Elias Hasas. Mostly parsers, decompressors, and the assumptions that survive a patch.
Working notes from going through CVE-2026-41992's fix commit: where the aliasing is written down, why AddressSanitizer reported nothing on a real out of bounds read, the structure-aware generator, and shrinking a candidate to eight bytes. With the commands.
The first fix cleared gzip's poisoned Huffman arrays in the branch that crashed, not in the function that reads them, leaving a tree walk eleven lines below it reading 32 KB past the allocation. Measured across three upstream revisions with a layout-independent oracle.