miso Security research notes https://hacchoomiso.github.io/feed.xml https://hacchoomiso.github.io/favicon.svg 2026-10-03T00:00:00+09:00 miso One Byte Too Far: Heap Buffer Overflow in Apache HTTP Server's mod_heartmonitor https://hacchoomiso.github.io/blog/OSS/CVE-2026-46729/ 2026-10-03T00:00:00+09:00 2026-10-03T00:00:00+09:00 An unauthenticated one-byte heap buffer overflow in Apache HTTP Server's mod_heartmonitor (CVE-2026-46729), present since 2009 — independently discovered and credited as a co-finding. The Unguarded Setting: GPU-to-Browser Sandbox Escape in Chrome via GTK3's Gtk/Modules XSETTING https://hacchoomiso.github.io/blog/Chrome/CVE-2026-76023/ 2026-09-22T00:00:00+09:00 2026-09-22T00:00:00+09:00 A compromised Linux/X11 GPU process could make GTK3 execute an attacker-controlled memfd in Chrome's browser process via the Gtk/Modules XSETTING (CVE-2026-76023, issue 545124048). The Fourth Pickle: Unauthenticated Remote Code Execution in SGLang's Disaggregated Diffusion Server https://hacchoomiso.github.io/blog/SGLang/CVE-2026-93088/ 2026-09-22T00:00:00+09:00 2026-09-22T00:00:00+09:00 Unauthenticated remote code execution in SGLang's disaggregated diffusion server (CVE-2026-93088, VU#727584, GHSA-8374-wrr5-7q7f), plus nine additional findings verified against upstream code.