cyberstan

Stan Shaw

I’m an independent security researcher focused on vulnerability discovery in widely-deployed infrastructure: operating system kernels, hypervisors, browsers, and language runtimes.

Public findings include a guest-to-host code execution in VMware Workstation and Fusion via the VMXNET3 virtual NIC (CVE-2026-59346, reported through Trend Micro ZDI), a pre-auth remote code execution in nginx’s script engine (CVE-2026-42533), a guest-to-host escape chain in QEMU’s CXL Type 3 mailbox emulation (writeup), a guest-triggered heap out-of-bounds in KVM’s SEV-SNP page-state-change handling (CVE-2026-53360), kernel privilege escalations in the Linux DRM GEM subsystem (CVE-2026-46215) and FUSE readdir cache (CVE-2026-31694), a SQL injection in the Django ORM (CVE-2025-64459), and a use-after-free in CPython’s perf_trampoline (Issue #143228).

Additional findings in browsers and mobile baseband are under coordinated disclosure and will be published here after patches ship.

Contact

Writing

Pre-auth RCE2026 · CVE-2026-42533
Capture clobbering in nginx’s script engine
A missing save/restore of PCRE capture state across the two-pass evaluator gives a heap overflow with controlled content and an info leak that defeats ASLR. Reliable pre-auth RCE.
VM escape2026 · CVE-2026-59346
Integer overflow in VMXNET3 TSO segmentation
A 32-bit multiply in the TSO allocation path wraps when seg_count × per_seg_size exceeds 232. Bypass of the CVE-2025-41236 patch. Reported through Trend Micro ZDI.
Kernel LPE2026 · CVE-2026-31694
Out-of-bounds write in the FUSE readdir cache
A missing bounds check latent since 2018, armed by a name-length raise in 2024, overflows 24 bytes into an adjacent page-cache page. Exploitation writeup of a bug found by others.
Kernel LPE2026 · CVE-2026-46215
Use-after-free in DRM GEM change_handle
An unprivileged render-node race frees a GEM object under a live handle and chains to passwordless root. Found independently.
KVM heap OOB2026 · CVE-2026-53360
Heap out-of-bounds in KVM SEV-SNP
A malicious SEV-SNP guest walks a guest-sized PSC buffer off its end to read and corrupt the host kernel heap.
VM escape2026 · QEMU
Guest-to-host escape via QEMU CXL mailbox
Three CXL Type 3 mailbox bugs chain into a deterministic guest-to-host escape with a full ASLR bypass.
ORM SQLi2025 · CVE-2025-64459
SQL injection in the Django ORM
Unsafe formatting of the Q object connector allows injection through Q(**user_input).

All writing →