#coordinated-disclosure

3 writeups.

Two weeks of silence, four fixes in an afternoon — and two bugs that nearly got away 28 Jul 2026

Client-side memory-safety bugs in libnfs and libsmb2 went nowhere for two weeks, then got fixed within hours of one follow-up — and the parts worth remembering are the disclosure mechanics and the two moments verification saved the report.

coordinated-disclosure libnfs libsmb2 verification fuzzing
The bug that was already fixed: a missing backport in libebml 24 Jul 2026

A malformed-input path in libebml's EBML reader was already guarded on the v1.x branch but never forward-ported to master — a look at the missing-backport bug class and being wrong about a PoC while still being useful.

fuzzing libebml matroska variant-analysis coordinated-disclosure
From fuzzer crash to credible disclosure 21 Jul 2026

A practical workflow for turning parser crashes into verified, coordinated vulnerability disclosures.

fuzzing vulnerability-research coordinated-disclosure static-analysis