Security research

Vulnerabilities I found and disclosed to maintainers and vendors: privilege escalation, security bypasses, remote crashes, and broken end-to-end encryption. Filter by class or topic below.

class

topic

date	project	finding	identifiers
2026.10	sudo	Intercept and log bypass via int 0x80 security bypass In `intercept` and `log_subcmds` mode on Linux, an x86_64 binary using the legacy `int 0x80` syscall path made sudo read its registers with the wrong layout. The `execve` then ran neither intercepted nor logged. commit Reported independently; first report by Pedro Henrique de Almeida Silva.
2026.08	sudo-rs	sudoedit symlink race to root privilege escalation Path sanitization in `sudoedit` ran twice: once for the policy check, once to pick the file to open. A user allowed to edit a single file could flip a symlink between the two to write into any directory, and reach root via `/etc/sudoers.d`. advisory	CVE pending CVSS 6.4 · medium
2026.07	rsyslog	Remote crash via regex framing denial of service An unauthenticated TCP client could terminate `rsyslogd` by sending crafted input to an `imptcp` listener configured with `framing.delimiter.regex`. advisory	CVE-2026-19654 CVSS 7.5 · high
2021.08	Bridgefy	Breaking Bridgefy, again cryptographic break The mesh messenger had adopted libsignal after earlier attacks. A race between queuing a message and fetching its key let an attacker read Signal-encrypted private chats anyway. Broadcasts were recoverable without the network key, and impersonation, interception, and user tracking still worked. paper With Martin R. Albrecht and Kenneth G. Paterson. Published at USENIX Security 2022.	no CVE requested

Say hello.

Thoughts, suggestions, or just want to chat about all things tech? Reach out.

eikenberg.at LinkedIn