Post #4361735

2026-08-03 18:31 UTC

So, keep this with a few grains of salt but the github commits list an actual email address, associated with Wuhan University: https://github.com/programmervuln/cveadvisory-/commit/bfbf978edfac5579794e6ee128bd4c88f42324cd.patch This email ID can be found associated with two papers on Researchgate, best I can tell (from the preview) with an Author of the papers: https://www.researchgate.net/publication/410776497_MLG-UAF_Perturbation-Invariant_Spatial_Graph_Framework_for_Adversarial_Use-After-Free_Threat_Identification https://www.researchgate.net/publication/403701529_IEEE_INTERNET_OF_THINGS_JOURNAL_1_VLM-Based_UAF_Vulnerability_Detection_for_Hardware-Constrained_IoT_Devices Unfortunately I can't actually tickle out of RG which author & I made the mistake of sending one (1) curl request to RG so I am now IP blocked, lmao, so I can't even check the actual papers anymore if they are related. Obvious salt: Git commit emails are spoofable, this is no proof that the owner of that address indeed made these commits.

Replies (1)

@nyanbinary@infosec.exchange 2026-08-03 18:39

Ok, the first one is absolutely it: Furthermore, we deploy MLG-UAF to conduct large-scale security auditing on mainstream open-source software such as libtiff, LibRaw, SQLite, ImageMagick and Zephyr RTOS. In real-world industrial source code scanning, our framework successfully discovered 17 unique confirmed UAF vulnerabilities assigned with independent Common Vulnerabilities and Exposures (CVE) IDs (CVE-2026 series, RESERVED and not yet publicized), covering cross-functional kernel UAF, intra-procedural cache UAF, race-condition UAF and multimedia parsing UAF scenarios.Real CVE case studies on CVE-2026-51291 (SQLite JSON cache flaw) and CVE-2023-32233 (Linux netfilter kernel vulnerability) demonstrate that MLG-UAF can precisely capture the fixed free-then-use spatial topological fingerprint of UAF defects and accurately resolve ambiguous multi-level pointer aliasing, even under heavy control-flow obfuscation.

Open ##4361867