A crafted DOCX containing a cycle in its w:basedOn style chain sends docx4j into uncontrolled recursion and ends with a StackOverflowError. This affects docx4j through 11.5.13 and was fixed in 11.5.14.

I traced severe desktop lag to a Japanese IME Registry handle leak that left ctfmon.exe holding more than 104,000 handles. A zero-capability AppContainer reproduced it on Windows 10, and MSRC classified the finding as a product reliability bug.

An old finding from 2019; the CVE was requested in 2020, approved by MITRE in August 2023, and sat in RESERVED state since. I was busy with life and didn't get around to writing it, doing the responsible disclosure now.

A short writeup for an old CVE I was credited on during my time at Sompo. I held onto this draft for a while due to life and NDA.

Been a long, long time since I last touched CTFs. It wasn't any official team by any means, so I had to do multiple categories by myself in the few hours limited weekend time I had for the CTF.

While bug hunting, I stumbled upon an open source repository which had been the cause of several of my bug bounty reports. This post goes into the details.