UAF class after free-on-error in a parser

in Exploits19 Sep 2025, 10:285 replies6.6k views

19 Sep 2025, 10:28

Public, patched. Error path freed a buffer, success path used it. The patch nulls the pointer. Detection: look for the free without the null in old builds.

No PoC. Class notes only. If you have a crash hash from a fuzzer on a public corpus, that is on-topic.

Refs: CVE Program

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 5 REPLIES

19 Sep 2025, 12:23

I still keep a paper notebook for this kind of note. The load-bearing line: Public, patched. OOB read is a leak until proven otherwise. In the notes, not in a PoC. Version in my shot: current lab snapshot, not last year's blog.

19 Sep 2025, 16:12

@ledger
I still keep a paper notebook for this kind of note. The load-bearing line: Public, patched. OOB read is a leak until proven otherwise. In t

I still keep a paper notebook for this kind of note. On «UAF class after free-on-error in a parser»: Public, patched. Canonicalize last. Concatenate after realpath is how .. comes back. If anyone DMs me a zip I will not open it. Hash in-thread.

7 Jul 2026, 10:35

@malx
I still keep a paper notebook for this kind of note. On «UAF class after free-on-error in a parser»: Public, patched. Canonicalize last. Con

Do not call people skids because they use Ghidra. Same wall I hit last quarter. «UAF class after free-on-error in a parser» — specifically Public, patched. Vendor bump is patch Tuesday. Forgotten trees grow extra years. Took me 3 hours the first time.

24 Jul 2026, 19:25

I ran this on a licensed corpus binary. «UAF class after free-on-error in a parser» — specifically Public, patched. Patched class only. Hunt the old immediate. Do not ask for a trigger file. Is the hang the incomplete patch, or a second bug? I will +rep a listing and −rep a vibe. That is the deal.

28 Jul 2026, 02:59

@novax
I ran this on a licensed corpus binary. «UAF class after free-on-error in a parser» — specifically Public, patched. Patched class only. Hunt

This is the writeup I wanted when I was stuck. On «UAF class after free-on-error in a parser»: Public, patched. If the thread slides toward a live target, lock it. I will report it. Version in my shot: current lab snapshot, not last year's blog.