| Encrypted anti-cheat kernel callback protections |
Hypervisor-based virtual machine introspection and EPT tracing |
| Hardcoded authentication bypass in router firmware |
Filesystem extraction with static control-flow graph analysis |
| Hardened enclave page-table memory access pattern |
Controlled-channel page-fault side-channel trace reconstruction |
| Locked baseband processor cellular protocol parser |
Over-the-air frame emulation and emulated firmware harness fuzzing |
| Obfuscated DRM white-box AES key schedule |
Differential computation analysis on dynamic memory access traces |
| Obfuscated JavaScript anti-bot browser fingerprint |
Abstract syntax tree deobfuscation and instrumented DOM hooked replay |
| Obfuscated mobile application API pinning logic |
Dynamic binary instrumentation hooking with Frida at runtime |
| Protected AMD-SEV-ES encrypted-register-state VMSA swap-signature verification |
Hypervisor VMRUN VMSA-physical-page remapping and #VC handler register probe |
| Protected AMD-SEV-SNP GHCB MSR-protocol state |
Hypervisor MSR_AMD64_SEV_ES_GHCB page-register request-response fuzzing |
Protected AMD-SEV-SNP Guest-Request SNP_GUEST_REQUEST AES-GCM nonce-reuse |
Hypervisor message-sequence-number replay and VMCK key-stream XOR recovery |
| Protected AMD-SEV-SNP RMP reverse-map-table hypervisor-pvalidate race |
Concurrent PVALIDATE and host-page-table RMPUPDATE dual-core race fuzzing |
| Protected AMD-SEV-SNP VMSA guest-interrupt injection |
Hypervisor EVENTINJ vector-spoofing during unvalidated #HV doorbell delivery |
Protected AMD-Zen4/5 STLF store-to-load-forwarding speculative-type-confusion |
High-resolution RDPRU cycle-counter cache-probe across aliased-stack stores |
| Protected Android Keystore hardware-backed key blob |
Keymaster HAL IPC hooking and TrustZone command-buffer structure parsing |
| Protected Android Verified-Boot dm-verity rootfs integrity |
Bootloader fastboot command fuzzing and UART u-boot environment injection |
Protected Android-14 ashmem/memfd seal-bypass F_SEAL_FUTURE_WRITE race |
Cross-process mmap shared-page write-fault before fcntl seal-commit check |
Protected Android-15 libbinder_ndk VINTF-stability check |
System-to-vendor stable-AIDL wire-format version-skew fuzzing and bit-flip |
Protected Android-15 rkpd CBOR-COSE geek-chain check |
Protected-VM BCC boot-certificate-chain parser fuzzing and EEK-key swap |
| Protected Android-15 IGraphicBufferProducer fence race |
Concurrent queueBuffer and detachBuffer binder-transaction refcount fuzzing |
| Protected Android-AVF Android-Virtualization-Framework pKVM stage-2 hypercall |
__pkvm_host_share_hyp donate/unshare state-machine transition fuzzing |
| Protected Apple iOS SEP secure-enclave firmware |
Blackbird/checkm8 bootrom vulnerability demotion and JTAG decryption |
| Protected Apple-M-series GPU RTKit mailbox-ring |
IOGPU shared-memory ring-descriptor size-mutation and panic-log decoding |
| Protected Apple-M-series Pointer-Authentication-Code PAC kernel-signing key-diversity |
Cross-EL1/EL0 pacibsp gadget-invocation under debugger-exception context |
| Protected Apple-M3/M4 GPU-shader dynamic-caching register-spill leak |
Metal compute-kernel occupancy-contention timing probe and wavefront residue |
| Protected Apple-M4 PACGA side-channel timing |
High-resolution PMU-counter pipeline-stall measurement on pacga key-dependent contention |
Protected Apple-M4 SME ZA-array context-switch leak |
Streaming-SVE mode-transition svcr exception-race and tile-register probe |
| Protected Apple-S-series SEP AES key-sideload |
Electromagnetic correlation-analysis on SEP boot-Monitor key-unwrap operation |
| Protected Apple-Silicon APRR page-permission hardware register |
JIT-region s3_6_c15 system-register write-gadget scan and thread-local race |
| Protected ARM-CCA Confidential-Compute-Architecture Realm-Management-Monitor RMI |
Host-to-RMM RMI_GRANULE_DELEGATE state-table race and Stage-2 RTT probing |
| Protected ARM-CCA RSI RIPAS-state transition |
Realm-to-Host RSI_HOST_CALL memory-unmap race and Stage-2 S2AP permission probe |
| Protected ARM-v9 RME Granule-Protection-Table walk |
EL3 monitor GPT_ENTRY PAS-physical-address-space transition race fuzzing |
| Protected bootrom secure-boot signature check |
Voltage fault-injection glitching during instruction fetch |
| Protected browser Cross-Origin-Opener-Policy site-isolation boundary |
Speculative-execution timer-less CSS/SVG shared-process contention probing |
| Protected Chrome-Blink Oilpan garbage-collector concurrent-marking write-barrier |
Cross-thread heap-object mutator-race fuzzing and RawPtr quarantine bypass |
Protected Chrome-V8 Maglev CheckMaps inline-cache |
Map-deprecation transition-tree race and float64-to-tagged-pointer confusion |
| Protected Chrome-V8 Sandbox 40-bit compressed-pointer ExternalPointerTable |
In-sandbox heap-corruption table-index swap and type-tag bit-mask audit |
| Protected Chrome-V8 WasmGC type-canonicalization confusion |
Cross-module recursive-type-group index-collision fuzzing and heap-sandbox escape |
| Protected cloud-provider Nitro/SEV confidential-VM memory |
Ciphertext-side-channel memory-bus snooping and nested-paging fault trace |
| Protected contactless NFC payment EMV cryptogram |
Proxmark RF field relay and APDU command-response state tree exploration |
Protected Credential-Guard LsaIso.exe VTL1 RPC-marshaling check |
Isolated-User-Mode ALPC-to-VTL1 NDR-stub decompilation and buffer-size fuzzing |
| Protected digital-cinema DCP encrypted content key |
Trusted-device certificate-chain extraction and FPGA decrypter bus probing |
| Protected discrete TPM-2.0 bus-reset state |
TPM locality-request bus-interposer state-reset injection after PCR extend |
| Protected Firefox-SpiderMonkey WarpBuilder Ion-JIT bounds-check-elimination bug |
Specter-mask index-aliasing JS-fuzzer and IonGraph MIR range-analysis dump |
| Protected hardware-security-module PKCS#11 API wrapper |
PKCS#11 command-attribute wrapping matrix and key-handle state fuzzing |
| Protected Hyper-V VMBus ring-buffer race condition |
Guest-kernel vmbus packet-header double-fetch mutation fuzzing |
| Protected Intel-Boot-Guard ACM authenticated-code-module RSA-3072 key-manifest |
SPI-flash descriptor-region read-timing and S3-resume BootScript table modify |
Protected Intel-CET Indirect-Branch-Tracking ENDBR64 CFI check |
JIT-sprayed misaligned-instruction ENDBR64 byte-sequence search and JOP chain |
Protected Intel-SGX ocall pointer-return bounds-check omission |
Edger8r bridge-function static-taint scan and enclave-heap pointer-injection |
| Protected Intel-SGX DCAP attestation-collateral parser |
PCK-certificate-chain SGX-TCB-info ASN.1 extension-oid parser mutation fuzzing |
| Protected Intel-SGX enclave timer-less execution |
Shared-cache eviction-set counter-thread high-resolution clock recovery |
| Protected Intel-TDX L1-to-L2 GPA-alias race |
L1-VMM concurrent TDCALL L2-page-permission modification and EPT-violation probe |
| Protected Intel-TDX MapGPA shared-bit page-aliasing race |
Concurrent guest-private-to-shared GPA-conversion and VMM EPT-violation fuzz |
Protected Intel-TDX Secure-EPT TDH.MEM.PAGE.AUG state-transition race |
Concurrent host-VMM TDH page-aug and guest TDG.MEM.PAGE.ACCEPT fuzzing |
| Protected Intel-TDX Trust-Domain-Extensions TDVMCALL hypervisor-input validation |
TD-shim #VE virtualization-exception handler MMIO-emulation fuzzing |
Protected Linux cachestat page-cache-residency cross-container timing |
Fine-grained cachestat file-offset probing of shared libc/binary pages |
Protected Linux cls_flower netlink refcount |
Concurrent RTM_NEWTFILTER and RTM_DELTFILTER RCU-grace-period race fuzzing |
Protected Linux io_uring IORING_REGISTER_RING_FDS table |
Concurrent thread io_uring_enter offset-index race and file-table UAF |
Protected Linux io_uring fixed-file reference-count underflow |
Concurrent IORING_REGISTER_FILES_UPDATE and IOSQE_FIXED_FILE race fuzzing |
Protected Linux nftables pipapo-set AVX2 out-of-bounds |
Netlink NFTA_SET_ELEM concatenated-range mutation and KASAN slab-redzone |
Protected Linux userfaultfd page-fault kernel-race window |
uffdio_copy deterministic thread-suspension replacement with FUSE/pipe stall |
| Protected Linux eBPF-ringbuf consumer-pos mmap-write |
User-space mapped consumer-page page-offset wrap-around verifier-mismatch test |
| Protected Linux kernel-address-space-layout-randomization KASLR offset |
Prefetch side-channel instruction-timing probe and translation-lookaside leak |
| Protected Linux Landlock sandbox path-beneath check |
landlock_add_rule syscall mount-namespace bind-mount rename race fuzzing |
Protected Linux-kernel af_unix unix_gc inflight-socket cycle |
Cyclic SCM_RIGHTS file-descriptor graph-passing and concurrent close race |
Protected Linux-kernel damon Data-Access-Monitor target-pid kfree-race |
Concurrent damon_sysfs pid-target-removal and monitoring-kthread walk |
Protected Linux-kernel io_uring IORING_OP_MSG_RING descriptor pass |
Concurrent ring-teardown and inflight msg_ring reference-count race fuzzing |
Protected Linux-kernel io_uring IORING_SETUP_IOPOLL completion race |
NVMe-polled queue submission/reap multi-core concurrency syzkaller fuzzing |
Protected Linux-kernel sch_taprio time-aware-shaper clockid race |
Concurrent tc-qdisc change and hrtimer-callback skb-dequeue UAF fuzzing |
| Protected Linux-kernel af_packet TX-ring race |
User-space mmap-ring tp_len concurrent-modification during tpacket_snd transmit |
| Protected Linux-kernel binder buffer-release alignment |
Unaligned binder_object size-overflow syzkaller-fuzzing and slab-UAF trigger |
| Protected Linux-kernel cls_u32 refcount underflow |
Netlink RTM_NEWTFILTER duplicate-handle replacement race with RCU callback |
| Protected Linux-kernel io_uring futex-wait race |
Concurrent async-futex cancellation and user-space futex-wake hash-bucket fuzzing |
Protected Linux-kernel SLUB-allocator CONFIG_SLAB_FREELIST_HARDENED xor-canary |
Cross-cache page-level Feng-Shui UAF avoiding freelist-pointer dereference |
Protected macOS Installd PackageKit symlink-traversal |
Preinstall-script TOCTOU directory-swap during PKInstallSandboxManager shove |
| Protected macOS Pointer-Authentication-Code PAC signing-oracle gadget |
pacda/autda kernel-gadget cross-reference scan and speculative forge |
| Protected modern CPU Intel-CET shadow-stack enforcement |
Call-oriented programming gadget chaining and context-switch state corrupt |
| Protected PCIe-5.0 Integrity-and-Data-Encryption IDE stream key-rotation |
CXL/PCIe flit-mode protocol-analyzer tap and K_gossip management-frame probe |
| Protected PCIe-ATS Address-Translation-Services untrusted-device IOTLB cache |
Malicious-endpoint translated-TLP DMA injection bypassing IOMMU remapping |
| Protected PCIe-CXL Type-3 memory-expander HDM-decoder range |
CXL.io configuration-space register probing and physical-address aliasing test |
| Protected Qualcomm Gunyah-hypervisor RM-RPC message |
VM-to-VM shared-memparcel capability-id fuzzing and hyp-call parameter probe |
Protected Qualcomm-QSEE .mbn ELF-segment hash-table gap |
PIL-loader non-contiguous physical-memory segment-overlap DMA-injection test |
Protected RISC-V WorldGuard pmpcfg TOR-mode |
Machine-mode mstatus.MPRV unaligned-access boundary-crossing privilege probe |
| Protected Samsung-Knox HDM EL2-SMC call-table |
Knox-vault SMC-function-id register-fuzzing and RKP page-table read-only bypass |
| Protected SEV-SNP confidential-VM page-validation state |
Hypervisor nested-page-table remapping and VMGEXIT GHCB protocol fuzzing |
| Protected smart-meter DLMS/COSEM HLS-GMAC authentication |
Optical-probe frame injection and invocation-counter replay testing |
| Protected Trusted Execution Environment trustlet code |
Secure-world SMC call fuzzing and shared-memory race condition scan |
Protected UEFI PiSmmCpuDxeSmm rendezvous lock |
Asynchronous SMI-storm injection during AP-startup and SMM-comm-buffer race |
| Protected WebGPU compute-shader shared-memory isolation |
SPIR-V/WGSL barrier-omission race fuzzing and GPU-cache timing probe |
Protected WebKit JavaScriptCore DFG/FTL-JIT CheckStructure transition-elimination |
Object-prototype-chain watchpoint-invalidation race and structure-ID spray |
| Protected Windows Virtualization-Based Security VTL1 code |
Hypercall interface opcode reverse engineering and secure-kernel debugging |
Protected Windows-11 afd.sys RIO-buffer completion |
AFD_RIO_REGISTER_BUFFER virtual-address length-overflow and MDL-unlock race |
Protected Windows-11 clipsp.sys license-blob RSA |
Kernel-mode NtQueryLicenseValue license-policy-cache signature-bypass fuzzing |
Protected Windows-11 cloudfiles.sys reparse-point hydration buffer-overflow |
Malformed IO_REPARSE_TAG_CLOUD TLV-placeholder length-field kernel fuzzing |
Protected Windows-11 csc.sys offline-files ioctl race |
Unprivileged CscIoctlOpen handle-duplication and kernel-heap UAF fuzzing |
Protected Windows-11 http.sys QUIC-varint overflow |
Malformed-QUIC MAX_STREAMS/CRYPTO frame-coalescing kernel-pool fuzzing |
Protected Windows-11 ks.sys MDL-mapping double-fetch race |
User-mode KSSTREAM_HEADER frame-size modification during IRP staging |
Protected Windows-11 ntfs.sys $Attribute_List VCN-extents integer-underflow |
Crafted-VHD mount-fuzzing with out-of-order starting-VCN attribute-records |
| Protected Windows-11 dwmcore batch-command overflow |
MilConnection NtDCompositionProcessChannelBatchBuffer command-id structure fuzz |
| Protected Windows-11 ExAllocatePool2 heap-cookie XOR |
Segment-heap _HEAP_VS_CHUNK_HEADER encoded-size leak and LFH bucket alignment |
Protected Windows-11 Kernel-Data-Protection MmAllocateIndependentPages VTL1 lock |
Secure-Pool section-mapping race before VslpEnterIumSecureMode hypercall |
| Protected Windows-11 mskssrv.sys context reference-leak |
Concurrent FSInitializeContextRendezvous IOCTL race and non-paged-pool UAF |
| Protected Windows-11 Pluton HSP-mailbox channel |
ACPI-table MHSP shared-buffer command-id enumeration and status-code probe |
| Protected Windows-11 tcpip.sys IPv6-fragment integer-wrap |
Jumbo-payload Next-Header offset-loop packet-injection with KASAN-enabled kernel |
| Protected Windows-Defender-Application-Control WDAC HVCI hypervisor code-integrity |
WHQL-signed vulnerable-driver RW-primitive and CiOptions page-table remap |
Protected Windows-HVCI ci.dll CiValidateImageHeader catalogue-hash race |
TOCTOU SMB-loopback remote-file page-modification during Authenticode verify |
| Protected Windows-Hypervisor-Platform WHPX Exo-partition MSR-bitmap intercept |
WHvRunVirtualProcessor exit-handler fuzzing and APIC-access page remapping |
Protected Xen grant_table v1-to-v2 race |
Concurrent GNTTABOP_set_version and GNTTABOP_map_grant_ref refcount fuzz |
| Uncovered closed parser memory corruption flaws |
Coverage-guided mutation fuzzing and address sanitizer instrumentation |
| Undisclosed cryptographic side-channel timing leak |
Constant-time static taint analysis and Welch t-test leakage measurement |
Undocumented win32kfull.sys desktop-heap user-callback race |
xxxClientAllocWindowClassExtraBytes hook-reentrancy and palette-object spray |
Undocumented Android credstore Identity-Credential CBOR-parser flaw |
Malformed COSE_Sign1/MAC0 structure-fuzzing against android.hardware.identity |
Undocumented Android libstagefright NAL-unit parser overflow |
Malformed SPS/PPS tile-grid dimension mutation and HWASan binder-harness |
| Undocumented Android Binder parcel-deserialization bug |
ServiceManager interface-token enumeration and structure-aware parcel fuzzing |
Undocumented Android-14 credstore binder-parcel auth-token timestamp-check |
HardwareAuthToken big-endian challenge-timestamp byte-order mismatch test |
Undocumented Android-Binder scatter-gather binder_buffer_object parent-offset |
Malformed BINDER_TYPE_PTR fixup-offset overlapping-buffer syzkaller fuzzing |
| Undocumented Android-BiometricPrompt face-unlock Teegris/QSEE trustlet IPC |
Camera-HAL secure-buffer ion-handle tracing and replay-flag bit-flip |
Undocumented Android-Keystore2 Rust-binder IKeystoreSecurityLevel operation-handle |
Concurrent update/finish binder-thread race and sub-component HAL fuzzing |
Undocumented Android-SELinux vendor_init property-context prefix-match bypass |
plat_property_contexts longest-prefix-match trie-collision and setprop audit |
Undocumented Apple-AirPlay2 FairPlay-v3 fp-setup Curve25519 state |
RTSP POST /fp-setup binary-blob interception and libfairplay trace |
| Undocumented Apple-HomeKit HAP-Pair-Setup SRP-6a TLV8 state |
mDNS _hap._tcp txt-record sniffing and M1-to-M6 pairing-TLV state mutation |
Undocumented Apple-VisionOS realityd shared-scene entity deserialization |
XPC-dictionary REAsset descriptor-mutation and Metal-buffer bounds check |
| Undocumented AppleNeuralEngine compiled-model weight encryption |
ANECompiler Mach-O segments and IOSurface DMA weight-buffer interception |
| Undocumented automotive UDS diagnostic SecurityAccess seed-key |
CAN-TP seed-request harvesting and firmware linear-congruential inversion |
| Undocumented hypervisor virtual-device DMA boundary bug |
Guest-to-host virtio ring descriptor fuzzing and IOMMU page-table audit |
Undocumented iOS audiod shared-memory ring-buffer bounds |
IOAudio2 time-of-check-to-time-of-use shared-buffer size-field mutation |
| Undocumented iOS Baseband-to-Application-Processor PCIe/IPC QMI message |
ARI/QMI packet-logger TLV-field extraction and baseband-modem panic trace |
| Undocumented iOS IOKit user-client external methods |
Binary symbol recovery with iometa and selector structure-size fuzzing |
| Undocumented iOS lockdownd pairing-record check |
SSL-split usbmuxd traffic interception and libimobiledevice state fuzzing |
Undocumented iOS-18 aneuserd Neural-Engine-Compilation Mach-O-section overflow |
Malformed-mlmodelc H16G-ISA weight-offset header fuzzing and IOMMU fault |
| Undocumented iOS-18 blastdoor AVIF-alpha overflow |
Malformed-ISOBMFF auxC alpha-plane dimension-mismatch fuzzing in Messages sandbox |
Undocumented iOS-amfid MISValidateSignatureAndCopyInfo provisioning-profile CDHash |
libmis.dylib entitlement-dictionary parser fuzzing and ASN.1 signer-info diff |
| Undocumented iOS-blastdoor Messages-sandbox NSKeyedUnarchiver class-allowlist |
plist $classes inheritance-chain fuzzing and Mach-port right leak check |
| Undocumented iOS-Continuity/AirDrop AWDL Apple-Wireless-Direct-Link TLV-frame bug |
802.11 action-frame radiotap-injection and wifid sync-tree state fuzzing |
| Undocumented iOS-CoreTrust DER-encoded CMS-signature code-directory hash-type |
Mach-O LC_CODE_SIGNATURE multi-CMS blob-nesting and ASN.1 length-field fuzz |
| Undocumented iOS-SpringBoard Darwin-notification lock-screen state-bypass trigger |
notify_post Darwin-notification fuzzing and SBCoverSheetViewController trace |
| Undocumented kernel driver IOCTL attack surface |
Symbolic driver interface recovery and structure-aware fuzzing |
| Undocumented Linux io_uring asynchronous-ring buffer-registration race |
Multi-threaded sqe-submission syzkaller fuzzing with KASAN instrumentation |
Undocumented Linux-cifs/smb3 smb2_parse_contexts durable-handle lease-v2 overflow |
Rogue-SMB3-server malformed CreateContexts offset-length syzkaller fuzzing |
Undocumented Linux-eBPF bpf_ringbuf_reserve spinlock-verifier state-pruning bug |
Branch-equivalence path-pruning state-mismatch crafting in eBPF verifier |
Undocumented Linux-io_uring IORING_OP_URING_CMD nvme-passthrough CQE overflow |
Custom 64-byte SQE command-pdu fuzzing against character-device uring_cmd |
Undocumented Linux-kernel bcachefs B-tree-node journal-replay extent-overlap |
Fuzzed-superblock btree-node-magic corruption with syzkaller mount-harness |
Undocumented Linux-kernel smb_direct RDMA-read-write FRWR memory-registration |
Rogue-RDMA-peer invalid rkey remote-invalidation packet-injection fuzzing |
| Undocumented Linux-ksmbd smb2_ioctl descriptor race |
Compound-request SMB2_IOCTL and SMB2_CLOSE multi-session syzkaller fuzzing |
| Undocumented Linux-KVM nested-VMCS12 shadow-field bitmap |
handle_vmread guest-hypervisor VMCS-link-pointer state-corruption fuzzing |
Undocumented Linux-Netfilter nf_conntrack ALGs application-layer-gateway port-open |
Crafted FTP/SIP/H.323 control-packet payload-mutation and nf_nat pinhole scan |
Undocumented Linux-nf_tables nft_byteorder register-truncation 64-to-32-bit bug |
Netlink expr-register alignment-offset crafting and slab out-of-bounds write |
Undocumented macOS launchd Mach-bootstrap port-swap check |
bootstrap_look_up audit-token PID-validation disassembly and XPC-domain fuzz |
Undocumented macOS securityd Keychain-ACL authorization-tag CSSM_ACL_SUBJECT |
Mach-IPC sec_keychain XPC-serialization fuzzing and ACL-prompt bypass |
| Undocumented macOS AMFI trust-cache static-hash lookup |
pmap_cs code-directory SHA-256 hash-tree sorting and kernel-cache extraction |
| Undocumented macOS Endpoint-Security XPC entitlement check |
Mach-service MIG subsystem parsing and audit-token validation analysis |
| Undocumented macOS Gatekeeper quarantine xattr-bypass |
Archive-unpack symlink-target com.apple.quarantine stripping and mount-flags race |
| Undocumented macOS TCC transparency-consent-control database bypass |
tccd XPC message entitlement-check disassembly and SQLite schema audit |
Undocumented macOS-DriverKit IOBufferMemoryDescriptor IOMMU-map length-overflow |
User-space Dext CreateSubRange offset-wrap RPC-fuzzing against kernel-iokit |
Undocumented macOS-Sequoia managedappdistributiond XPC-entitlement bypass |
NSXPCConnection audit-token validation-gap disassembly and MDM-install hook |
| Undocumented macOS-WindowServer SkyLight Mach-port type-check |
Unprivileged CGWindowID property-deserialization CFType-confusion fuzzing |
| Undocumented Netfilter nf_tables anonymous-set state transition |
Netlink batch-transaction commit/abort race syzkaller state fuzzing |
| Undocumented satellite DVB-S2 conditional-access scrambler |
Control-word sharing latency profiling and descrambler register dump |
| Undocumented satellite GPS L1-C/A civil-navigation spoofing |
Software-defined-radio coherent delay-lock-loop pull-off simulation |
| Undocumented StrongBox Titan-M2 APDU SPI transport |
SPI-bus logic-analyzer nosh-frame capture and CBOR command-schema fuzzing |
| Undocumented UEFI Capsule-Update Ed25519/RSA header verification |
UEFI-firmware-parser extraction and PEI-phase capsule-coalesce integer fuzz |
| Undocumented UEFI system-management-mode callout flaw |
SMM callout table static taint tracking and QEMU-KVM SMI fuzzing |
| Undocumented web assembly binary validation logic |
Wasm-to-C decompilation and dynamic memory heap breakpoint tracing |
| Undocumented Windows ALPC local-privilege-escalation port |
NtAlpcConnectPort handle enumeration and message-attribute fuzzing |
| Undocumented Windows CloudAP primary-refresh-token DPAPI blob |
LsaIso/Ngc session-key RPC interception and TPM-unseal handle tracing |
| Undocumented Windows Defender-ATP kernel-minifilter altitude callback |
FltEnumerateFilters kernel-structure walk and IRP-mj-create fuzzing |
Undocumented Windows Filter-Manager communication-port FltCreateCommunicationPort ACL |
Security-descriptor DACL auditing and unprivileged FilterConnectCommunicationPort |
| Undocumented Windows Kernel-Data-Protection VSM hypercall |
MmProtectDriverSection hypercall VTL1 page-attribute table inspection |
Undocumented Windows-Defender MsMpEng.exe emulated-filesystem VFS-sandbox escape |
Custom-packer resource-section anti-emulation timer-check and API-stub diff |
| Undocumented WPA3 Dragonfly handshake timing flaw |
Elliptic-curve group-element reflection and iteration-count timing probe |
| Undocumented Zigbee smart-home network transport key |
IEEE 802.15.4 packet sniffing and over-the-air commissioning capture |
| Unknown acoustic keyboard emanation side-channel leak |
Spectrogram time-difference-of-arrival and deep-learning keystroke classification |
| Unknown acoustic RSA private-key decryption leakage |
Ultrasonic microphone capacitor-hum capture and chosen-ciphertext attack |
| Unknown AMD-Zen4/5 Branch-Type-Confusion Phantom speculative-return-stack-buffer |
Misaligned-call/ret BTB-type-aliasing prime-and-probe microbenchmark |
| Unknown ARM Pointer-Authentication-Code PACMAN speculative-execution oracle |
Load-value-injection branch-predictor training and hardware-PMU timing |
| Unknown ARM-MTE tag-check speculative oracle leak |
Speculative tag-mismatch branch-predictor timing probe in Linux user-space |
| Unknown ARM-TrustZone OP-TEE pseudo-trusted-application invoke parameter |
Normal-world tee-supplicant shared-memory hooking and UUID enumeration |
| Unknown automotive CAN-FD controller-area-network Stuff-Bit-Count error-passive |
Arbitration-phase bit-flip dominant-override bus-off injection with FPGA |
| Unknown automotive FlexRay bus-guardian star-coupler window |
Out-of-slot symbol-window collision injection and bus-guardian state-machine probe |
| Unknown automotive immobilizer rolling-code cipher |
Key-fob RF frame capture and algebraic cryptanalysis |
| Unknown automotive keyless-entry ultra-wideband IEEE-802.15.4z distance |
Picosecond pulse-retransmission early-detect/late-commit physical-layer test |
| Unknown automotive SecOC AUTOSAR-Secure-Onboard-Communication freshness-value sync |
Truncated-MAC 24-bit brute-force window and Trip/Reset counter CAN-replay |
| Unknown automotive SOME/IP service-discovery spoofing |
UDP port-30490 OfferService injection and method-ID payload fuzzing |
| Unknown automotive-Ethernet gPTP grandmaster-clock takeover |
Announce-message priority1-field spoofing and pdelay-turnaround manipulation |
Unknown automotive-UDS AccessTimingParameter P2-server-max DoS exhaustion |
Diagnostic-session-control sub-function flood and CAN-gateway queue starvation |
Unknown automotive-UDS RequestUpload/TransferData bootloader-compression LZSS bug |
Simulated-ECU CAN-FD flash-download fuzzing with malformed back-reference offset |
| Unknown automotive-UDS RoutineControl erase-boundary bypass |
Start-address-plus-length 32-bit integer-wrap fuzzing against calibration-flash sector |
| Unknown BACnet MS/TP token-passing master-node state |
RS-485 token-frame slot-starvation and ReadPropertyMultiple object scan |
| Unknown BACnet/SC TLS-websocket hub-failover bypass |
BVLC-SC header-option mutation fuzzing and rogue-hub certificate-pinning check |
| Unknown battery-backed FPGA bitstream AES key |
Thermal-laser stimulation of BBRAM cells on powered-down silicon backside |
| Unknown biometric fingerprint sensor liveness check |
Capacitive/optical spoofing phantom fabrication and SPI bus interception |
| Unknown BLE LE-Audio Broadcast-Code encryption key |
BIGInfo advertising-pdu capture and low-entropy Broadcast-Code dictionary test |
| Unknown Bluetooth Channel-Sounding phase-ranging reflector attack |
Multi-tone phase-slope manipulation and NADM attack-detector metric probing |
| Unknown Bluetooth GATT service security model |
Active attribute enumeration and pairing key-exchange downgrade test |
| Unknown Bluetooth Link-Manager encryption key-size |
LMP_encryption_key_size_req 1-byte negotiation KNOB-style downgrade test |
| Unknown Bluetooth-LE Auracast Broadcast-Isochronous-Group BIG-Sync-Timeout DoS |
Spoofed-BIGInfo Akademia channel-map-update instant-offset injection |
| Unknown Bluetooth-LE Auracast ISOAL segmentation overflow |
Framed-PDU continuation-fragment length-mismatch over-the-air HCI injection |
| Unknown Bluetooth-LE Periodic-Advertising-with-Responses PAwR subevent-slot spoofing |
Synchronized SDR subevent-response injection during ESL electronic-shelf-label |
| Unknown Bluetooth-mesh smart-lock provisioning flaw |
PB-ADV bearer packet sniffing and ECDH public-key reflection attack |
| Unknown browser JIT-compiler type-confusion optimization bug |
Fuzzilli intermediate-language mutation fuzzing and turbofan graph dump |
| Unknown building-access OSDP Secure-Channel default key |
OSDP-SC osdp_CHLNG and osdp_SCRYPT capture with default master-key test |
| Unknown cellular 5G-NR SUCI subscription-concealed-identifier null-scheme |
Rogue gNodeB base-station NAS registration-reject downgrade probing |
| Unknown Classic-McEliece syndrome-decoding timing leak |
Patterson-algorithm Berlekamp-Massey degree-branch cache-line probing |
| Unknown container-runtime procfs symlink escape race |
File-descriptor /proc/self/fd race-condition fuzzing and namespace audit |
| Unknown cryptographic elliptic-curve invalid-curve fault attack |
Chosen-point faulted scalar multiplication and Chinese-Remainder recovery |
| Unknown cryptographic key in smart-card hardware |
Differential power analysis and correlation electromagnetic traces |
| Unknown defibrillator 175-kHz inductive-wand telemetry framing |
Near-field magnetic-loop capture and Manchester bit-stream command-fuzzing |
| Unknown DVB-RCS2 satellite return-link encryption |
L-band uplink burst-timing capture and known-plaintext header XOR analysis |
| Unknown EMV contactless-payment card-relay distance-bounding limit |
High-speed FPGA NFC-emulator latency-budget profiling under 500 microseconds |
| Unknown eSIM RSP-Remote-SIM-Provisioning GSMA-SGP.22 ES9-plus TLS-mutual-auth |
Local-Profile-Assistant eUICC APDU-trace and BoundProfilePackage ASN.1 fuzz |
| Unknown EtherNet/IP CIP-Safety time-coordination spoofing |
Produced/Consumed safety-tag sequence-count replay and timestamp-jitter test |
| Unknown FIDO2 caBLE/ctap2 tunnel-server QR-secret derivation |
BLE proximity-advertised eid-key decryption and WebSocket tunnel-handshake tap |
| Unknown GPS M-code spot-beam sidelobe leakage |
High-gain parabolic dish spatial-filtering and cross-correlation PSD |
| Unknown hardware-security-key FIDO2/WebAuthn resident-key flash wear-level |
SPI/internal-flash power-glitch readout and ECDSA nonce-bias lattice attack |
| Unknown hardware-security-module PCIe-card tamper-grid battery-removal zeroization |
Low-temperature -60C SRAM data-remanence freeze and supply-pin glitching |
| Unknown hardware-wallet cold-storage seed-phrase extraction |
Voltage-glitching microcontroller RDP-level downgrade and SRAM dumping |
| Unknown hardware-wallet Ed25519 deterministic-nonce SHA-512 fault-injection |
Single-bit laser/voltage glitch during second-pass r-scalar multiplication |
| Unknown hardware-wallet GlobalPlatform SCP03 key derivation |
Known-host-challenge power-trace collection and AES-CMAC key-schedule CPA |
| Unknown hardware-wallet masked-AES-256 first-order-boolean-to-arithmetic conversion |
Second-order bivariate mutual-information power-analysis across cycle offsets |
| Unknown hardware-wallet OLED-display power-supply side-channel leak |
Charge-pump capacitor voltage-ripple capture and PIN-digit correlation |
| Unknown hardware-wallet Secp256k1 scalar-blinding big-integer carry |
Single-trace EM-template attack on 32-bit-limb modular-addition carry propagation |
| Unknown hardware-wallet shamir-secret-sharing SLIP-0039 polynomial interpolation |
Power-analysis side-channel during GF(256) Lagrange-basis multiplication |
| Unknown heap-allocator metadata corruption primitive |
Shadow-memory heap layout visualization and feng-shui symbolic modeling |
| Unknown industrial HART-IP wireless-gateway pass-through command |
Session-initiation-request fuzzing and encapsulated sub-device Long-Address scan |
| Unknown industrial OPC-UA binary-protocol chunk-reassembly overflow |
Custom Boofuzz session-less message-chunk mutation and heap-sanitized server |
| Unknown industrial PLC ladder-logic command auth |
Network challenge-response replay analysis and bytecode decompilation |
| Unknown industrial SCADA Modbus/DNP3 function extension |
Function-code enumeration scanning and exception-response differential |
| Unknown industrial-PROFINET DCP-Set-Request unauthenticated station-name hijack |
Layer-2 ethertype-0x8892 multicast-frame spoofing and PLC connection-reset DoS |
| Unknown insulin-pump sub-GHz OOK-packet CRC polynomial |
Universal-Radio-Hacker bit-error syndrome matrix and RevEng CRC-model solve |
| Unknown Intel-AMX Advanced-Matrix-Extensions tile-register power-side-channel leak |
RAPL energy-status counter-sampling during TMULBF16 matrix-multiply loop |
| Unknown Iridium L-band ring-alert pager frame |
gr-iridium SDR burst demodulation and IRA subscriber-ID geographic clustering |
| Unknown Iridium-NEXT L-band beam-handoff Doppler table |
Multi-channel SDR burst-frequency tracking and TLE orbital-velocity fit |
| Unknown ISO-15118 Plug-and-Charge EXI XML-signature wrap |
GreenPHY PLC-modem MitM proxy and EXI-grammar schema-deviation fuzzing |
| Unknown JavaCard ArrayCopyNonAtomic tearing oracle |
Precision-timed VCC-glitch mid-copy byte-array corruption and PIN-counter reset |
| Unknown KNX-IP bus-coupler individual-address spoofing |
KNXnet/IP tunneling-frame injection and device-descriptor-type-0 read scan |
| Unknown license verifier conditional branch check |
Concolic execution and satisfiability modulo theories constraint solving |
| Unknown Linux eBPF verifier register-bounds bug |
Verifier-log range-tracking differential fuzzing and bytecode crafting |
| Unknown LoRa-FHSS Long-Range Frequency-Hopping-Spread-Spectrum header-grid sync |
Spectrogram hopping-grid trajectory-tracking and Viterbi-header decoding |
| Unknown LoRaWAN end-node AppKey provisioning flaw |
Join-request nonce replay analysis and AES-CMAC power side-channel |
| Unknown Matter-1.2 ICD Intermittently-Connected-Device Check-In-Protocol AES-CCM |
6LoWPAN sleepy-end-device wake-interval sniffing and counter-wrap replay |
| Unknown medical-DICOM PACS ASN.1 parser overflow |
DIMSE-pdu length-field mutation fuzzing and private-tag VR type confusion |
| Unknown medical-infusion-pump proprietary Wi-Fi drug-library update |
TLS certificate-validation bypass and binary drug-limit table diffing |
| Unknown medical-pacemaker MedRadio wake-up OOK sequence |
CC1101 sub-GHz transceiver preamble-sweep and battery-drain DoS testing |
| Unknown microarchitectural speculative execution leak |
Hardware performance counter probing and flush-reload cache timing |
| Unknown optical-fiber physical-layer tapping signature |
Coherent optical time-domain reflectometry and polarization-mode scatter |
| Unknown patient-monitor HL7-MLLP unauthenticated message injection |
Pipe-delimited MSH/OBX segment-field fuzzing and alarm-threshold override test |
| Unknown PCIe Direct-Memory-Access IOMMU bypass window |
PCILeech FPGA DMA packet injection and ACPI DMAR table inspection |
| Unknown post-quantum BIKE syndrome-decoder timing leak |
Cache-timing observation of rejection-sampling bit-flip position generation |
| Unknown post-quantum Classic-McEliece Goppa-polynomial support-splitting timing |
Additive-FFT root-finding cache-bank conflict observation via Prime-and-Probe |
| Unknown post-quantum Dilithium/ML-DSA signature rejection-sampling leak |
Single-trace power/EM profiling of polynomial coefficient norm-check loop |
| Unknown post-quantum Falcon Gaussian-sampler timing-leak |
IEEE-754 subnormal-mantissa division-latency side-channel during Bernshtein-trapdoor |
| Unknown post-quantum FrodoKEM matrix-multiplication EM leak |
Correlation electromagnetic-analysis on 16-bit integer-row dot-product loop |
| Unknown post-quantum HQC-KEM decoding power side-channel |
Single-trace electromagnetic template-attack on syndrome-computation weight |
| Unknown post-quantum Kyber/ML-KEM decapsulation side-channel |
Number-theoretic-transform electromagnetic trace template matching |
| Unknown post-quantum NTRU-Prime Bernstein-Yang GCD timing |
Constant-time swap-bit power-or-EM leakage correlation across division steps |
| Unknown post-quantum SPHINCS-plus FORS fault vulnerability |
Fault-injection bit-flip during Merkle-tree root-computation and leaf-key reuse |
| Unknown processor branch-target-buffer aliasing scheme |
Prime-and-probe indirect-branch address sweep and PMC misprediction count |
| Unknown processor Spectre-v2 BTB tag hash |
Performance-counter branch-misprediction probing with congruence-address sets |
| Unknown Profinet-IO real-time cyclic-data authentication |
DCP discovery-frame spoofing and acyclic-record read-index enumeration |
| Unknown proprietary VPN tunnel handshake vulnerability |
Man-in-the-middle state-machine fuzzing and cipher suite probing |
| Unknown Return-Oriented-Programming gadget chain layout |
Binary executable code-section scanning and semantic gadget synthesis |
| Unknown satellite Iridium-Certus L-band QPSK-frame scrambling |
Wideband SDR channelizer-bank capture and UW unique-word phase-ambiguity resolve |
| Unknown satellite Ku-band OFDM frame-sync preamble |
Universal-software-radio-peripheral 250-Msps capture and cyclic-prefix autocorrelation |
| Unknown satellite Starlink-Ku-band user-terminal OFDM-frame Doppler-precompensation |
Ku-band LNB downconversion and two-line-element orbital-Doppler removal |
| Unknown secure-IC laser fault-injection vulnerability |
Backside near-infrared laser scanning and register bit-flip mapping |
Unknown smart-card GlobalPlatform INSTALL-for-load DAP-signature bypass |
Load-File-Data-Block-Hash SHA-256 chaining-state reset and APDU-order fuzzing |
Unknown smart-card JavaCard JCSystem.beginTransaction commit-buffer tear-attack |
Contact-vcc precision-timed power-drop during persistent-array transaction abort |
| Unknown smart-card JavaCard applet-firewall object-sharing boundary |
Custom CAP-file bytecode verifier-bypass and AID context-switch probing |
| Unknown smart-card RSA-CRT Bellcore fault recovery |
Single-glitch clock/laser injection during dp/dq modular exponentiation |
| Unknown smart-contract Ethereum EVM reentrancy bug |
Bytecode symbolic execution and storage-slot taint dependency analysis |
| Unknown smart-grid synchrophasor UDP-multicast spoofing window |
Phasor-data-concentrator timestamp-skew injection and CRC-CCITT frame craft |
| Unknown smart-lock MIFARE-DESFire-EV1/EV2 3DES-to-AES key-version rollback |
ISO-14443-4 AuthenticateISO vs AuthenticateAES error-timing side-channel |
| Unknown Thread-network Mesh-Local-EID MLE-link-request Reed-router promotion |
802.15.4 MLE-Parent-Request flood and Router-ID-assignment table exhaustion |
| Unknown Thuraya GMR-1 A5-GMR-2 stream-cipher state |
SDR burst-synchronization and known-FACCH-plaintext algebraic state-recovery |
| Unknown USB-HID wireless mouse-keyboard keystroke injection |
2.4-GHz nRF24 frame sniffing and unencrypted packet-acknowledge injection |
| Unknown Wi-Fi beamforming channel-state-information privacy leak |
Monitor-mode CSI matrix extraction and multipath activity classification |
| Unknown Wi-Fi-6E/7 Multi-Link-Operation MLO association-frame downgrade |
802.11be management-frame beacon-element mutation and MAC-address link test |
| Unknown Wi-Fi-Fine-Timing-Measurement 802.11mc RTT indoor-positioning spoofing |
LTF-symbol phase-shift injection and picosecond time-of-departure manipulation |
| Unknown WPS-PIN Pixie-Dust weak nonce seed |
M1-M3 EAP-message E-Hash1/E-Hash2 offline PRNG-state brute-force recovery |
| Unknown Z-Wave S2 ECDH-PIN brute-force window |
Zniffer 908-MHz inclusion-frame capture and 16-bit PIN-missing curve-point |
| Unknown Zigbee Green-Power commissioning-frame replay |
32-bit security-frame-counter window probing and GPDF-command injection |