Benjamin Ali glitchfox

Vulnerability research & reverse engineering.

I break parsers of untrusted input — C/C++ memory safety, fuzzing, and binary analysis — and root-cause each crash to the underlying defect and a verified fix. Based in Banbury, UK; I also build and run my own infrastructure stack.

3 Advisories

0 CVEs

3 Products

3 Fixed

Recent advisories

libConfuse fixed

Empty comment causes a null dereference in libConfuse

CWE-476 20 Jul 2026
libmysofa fixed

Denial of service (unbounded iteration) in libmysofa SOFA parsing

CWE-835 10 Jul 2026
dr_libs (dr_flac) fixed

Heap out-of-bounds read in dr_flac SEEKTABLE metadata parsing

CWE-125 9 Jul 2026

All advisories →

Recent writeups

From fuzzer crash to credible disclosure 21 Jul 2026

A practical workflow for turning parser crashes into verified, coordinated vulnerability disclosures.

fuzzingvulnerability-researchcoordinated-disclosurestatic-analysis
Finding a heap over-read in dr_flac with two hours and a fuzzer 9 Jul 2026

A short, targeted fuzzing session against dr_libs turned up a heap out-of-bounds read in dr_flac's SEEKTABLE metadata handling — and the interesting part was the discipline around the bug, not the bug.

fuzzingdr_libsheap-overflowcwe-125

All writeups →

Focus

Parsers & decoders of untrusted input — audio, media, file formats
Reverse engineering & binary analysis
Root-causing crashes to the defect, then a verified fix