@patchhawk_

🦅 The changelog says "bug fixes." The diff says "security patch." We track CVE-less fixes so defenders don't fly blind. New drop every Thursday. @78_lab

Joined June 2026
  • Tweets163
  • Following2
  • Followers72
52Media
Include

Only show posts containing:

Exclude

Hide posts containing:

Time range
-
Minimum likes
PatchHawk scans release diffs for security fixes. For selected cases, we share the input, Docker steps, and before/after logs so you can check our work: github.com/78ResearchLab/Pat… Follow @patchhawk_ for more patch notes backed by code. #PatchHawk #78ResearchLab

GitHub - 78ResearchLab/PatchHawk-PoC

Contribute to 78ResearchLab/PatchHawk-PoC development by creating an account on GitHub.

github.com
31
PatchHawk flagged pngrutil.c in the diff. We ran the same PNG through libpng’s public API on both releases. ASan caught a one-byte read from freed memory in 1.6.58. The 1.6.59 run ended with a handled parser error and no ASan finding. PoC: github.com/78ResearchLab/Pat…
2
1
72
In our test, a broken zTXt chunk leaves zlib pointing into libpng’s chunk buffer. The next, larger tEXt chunk frees that buffer. In 1.6.59, libpng clears the pointer before releasing the stream. Patch: github.com/pnggroup/libpng/c…
CVE-2026-46675 in libpng. The PRE panel says this helper did not exist in 1.6.58. The POST panel shows the full new function: it sets next_in and next_out to NULL, then avail_in and avail_out to zero. The other card shows where libpng calls it before releasing the stream.

ALT CVE-2026-46675 in libpng. The PRE panel says this helper did not exist in 1.6.58. The POST panel shows the full new function: it sets next_in and next_out to NULL, then avail_in and avail_out to zero. The other card shows where libpng calls it before releasing the stream.

1
45
libpng 1.6.58 has a use-after-free in an unusual read path. A crafted PNG can make libpng read freed memory if an app calls png_read_end() after png_read_info() but before reading any image rows. Version 1.6.59 fixes it. Advisory: github.com/pnggroup/libpng/s…
CVE-2026-46675 in libpng. Two stacked code panels show the compressed-text release path. In 1.6.58, it only sets zowner to zero. In 1.6.59, it calls png_inflate_detach_buffers first. The error check above and the end of the block remain visible. For a crafted PNG and a read-end call before any image rows, the old path could use a pointer to freed data.

ALT CVE-2026-46675 in libpng. Two stacked code panels show the compressed-text release path. In 1.6.58, it only sets zowner to zero. In 1.6.59, it calls png_inflate_detach_buffers first. The error check above and the end of the block remain visible. For a crafted PNG and a read-end call before any image rows, the old path could use a pointer to freed data.

1
1
80
PatchHawk looks for security fixes in software updates. For selected cases, we share the code change and steps to reproduce the bug: github.com/78ResearchLab/Pat… Follow @patchhawk_ for more fixes explained through code. #PatchHawk #78ResearchLab

GitHub - 78ResearchLab/PatchHawk-PoC

Contribute to 78ResearchLab/PatchHawk-PoC development by creating an account on GitHub.

github.com
2
2
96
Firefox 151.0.3 includes Mozilla's fix. On Linux, Firefox uses the system FreeType library, so updating Firefox doesn't update that library. PatchHawk compared the releases. We matched the change to this CVE and ran the Docker test ourselves. mozilla.org/en-US/security/a…

Security Vulnerabilities fixed in Firefox 151.0.3

mozilla.org
1
1
1
121
FreeType later changed SHZ, the instruction that moves points in a glyph. It now picks the right set of points and stops at the end of that set. The two cards show the code. This fix came after 2.14.3. github.com/freetype/freetype…
1
2
2
116
In Docker, we used a small program to load Mozilla's font through FreeType's public FT_Load_Glyph API. ASan found no issue with 2.14.2, but caught a read past the end of a buffer in 2.14.3. Mozilla also reported a write past a buffer. bugzilla.mozilla.org/show_bu…

2038537 - (CVE-2026-10701) FreeType 2.14.3 TT SHZ: 8-byte OOB write per instruction from composite...

RESOLVED (jfkthame) in Core - Graphics: Text. Last updated 2026-09-02.

bugzilla.mozilla.org
1
2
3
101
The change is easy to miss. In 2.14.2, FreeType made room for the glyph's existing points, plus four more. In 2.14.3, it only made room for four. That wasn't enough for some glyphs made from other glyphs. github.com/freetype/freetype…
1
2
2
122
FreeType 2.14.3 introduced a font rendering bug (CVE-2026-10701). Mozilla reproduced a Firefox crash on Linux by loading a specially made font with medium or full hinting enabled. The bug starts with a check that reserves too little memory.
1
3
6
322
PatchHawk finds security-relevant fixes in release diffs. Selected PoCs include write-ups, repro steps, and pre/post comparisons: github.com/78ResearchLab/Pat… Follow @patchhawk_ for more fixes explained with real code and verifiable PoCs. #PatchHawk #78ResearchLab

GitHub - 78ResearchLab/PatchHawk-PoC

Contribute to 78ResearchLab/PatchHawk-PoC development by creating an account on GitHub.

github.com
4
3
276
The PoC is now public: github.com/78ResearchLab/Pat… It includes the 345-byte JXL input, Docker reproduction scripts, 0.11.1/0.11.2 djxl logs, and the Valgrind trace. The README states the tested 32-bit scope and limitations.
1
2
2
167
Upstream named the fix in v0.11.2: github.com/libjxl/libjxl/rel… Patch: github.com/libjxl/libjxl/pul… PatchHawk flagged the arithmetic change; its PoC attempt was incomplete, so we verified the CLI and Valgrind results manually.

Release v0.11.2 · libjxl/libjxl

Fixed fix tile dimension in low memory rendering pipeline (#4495 - CVE-2025-12474) fix number of channels for gray-to-gray color transform (#4579 - CVE-2026-1837) djxl: reject decoding JXL files i...

github.com
1
2
2
141
The native 32-bit CLI exited 139 on 0.11.1. Version 0.11.2 returned a frame-creation error for the same file; a 256×256 control decoded on both. We did not establish code execution or a downstream network path.
1
2
2
100
Before the fix, PackedImage::Create() allocated after unchecked size arithmetic. The decoder’s output callback then wrote beyond that buffer. The patch calls VerifyDimensions() first and rejects wrapped stride or total size. The card shows the actual code change.
1
2
3
132
The JXL file holds an 8×8 cropped frame on a 32,768×10,923 canvas. djxl --disable_output still decodes to float RGB pixels. Packed storage would need 4,295,098,368 bytes (2³² + 131,072), which wraps in 32-bit size_t.
1
2
2
127
libjxl 0.11.2 checks packed-image size before allocation. In our native 32-bit djxl test, a 345-byte JXL file crashed 0.11.1; Valgrind recorded invalid 4-byte writes. 0.11.2 rejects the same file.
1
2
2
216
PatchHawk finds security-relevant fixes in release diffs. Selected PoCs include write-ups, repro steps, and pre/post comparisons: github.com/78ResearchLab/Pat… Follow @patchhawk_ for more fixes explained with real code and verifiable PoCs. #PatchHawk #78ResearchLab

GitHub - 78ResearchLab/PatchHawk-PoC

Contribute to 78ResearchLab/PatchHawk-PoC development by creating an account on GitHub.

github.com
2
2
96
Both reproductions use FFmpeg's CLI entry points and are packaged in Docker. They show sanitizer-detected writes; we did not demonstrate code execution or an unsanitized crash. Ogg PoC: github.com/78ResearchLab/Pat… Filter PoC: github.com/78ResearchLab/Pat…

PatchHawk-PoC/78RL-2026-0008/README.md at main · 78ResearchLab/PatchHawk-PoC

Contribute to 78ResearchLab/PatchHawk-PoC development by creating an account on GitHub.

github.com
1
2
2
96
That leftover multiplication matters. delay=12180 passes the new 9.0.2 check. In our x86-64 sanitizer build, it overflows and ASan catches a 4-byte heap write just before analysis_buf. The same input faults on 9.0.1. For this build, the 9.0.2 check is incomplete.
1
2
2
72
Load more