# 637th Research Lab

> Security research write-ups: reverse-engineering, vulnerability discovery, and the methodology behind them.

637th Research Lab (https://y637f9qq2x.com/) is written by Kazuma Matsumoto. Focus areas: Windows internals, Linux internals, Reverse engineering, AI-assisted security research, Web application security. Every vulnerability described here was disclosed to the affected vendor before it was published. 10 articles are published, and each one is also served as markdown at https://y637f9qq2x.com/llms/<slug>.md. Every markdown file names its author, its publication and its canonical URL. Quote the canonical URL when citing an article.

## Posts

- [CVE-2026-5917: OS Command Injection in libgit2’s SSH Backend](https://y637f9qq2x.com/posts/cve-2026-5917/): libgit2’s libssh2 backend quotes the repository path but escapes nothing. One quote in the path can run commands on an SSH server that gives a shell.
- [CVE-2026-5857: Remote Code Execution in Contiki-NG’s MQTT Client](https://y637f9qq2x.com/posts/cve-2026-5857/): A malicious broker splits one PUBLISH across two TCP segments, skips a bounds check that is present and correct, and overwrites a function pointer.
- [CVE-2026-18759: Privilege Escalation in ASUSTOR Backup Plan](https://y637f9qq2x.com/posts/asustor-lpe/): ASUSTOR Backup Plan’s Windows service ABP_VSS_Service treats encryption as authentication and checks paths with a substring test. Standard user to SYSTEM.
- [Claude Cowork Boots Its Sandbox From a Folder You Can Rewrite](https://y637f9qq2x.com/posts/cowork-boot-trust/): Cowork boots a Hyper-V VM from user-writable AppData with no hash or signature check. Replace the initrd; SYSTEM boots it. Anthropic: by design.
- [U-Boot TCP/NFS Vulnerabilities: Integer Underflow and Buffer Overflow in the World’s Most Popular Bootloader](https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/): Three CVEs in U-Boot’s network stack: one unchecked TCP header length that gives two reads past the packet, and an NFS path overflow past a 2048-byte buffer.
- [Four Vulnerabilities in barebox: From DHCP Parsing to EFI PE Loading](https://y637f9qq2x.com/posts/barebox-sandbox-vulns/): Four CVEs in barebox: an unbounded DHCP option scan, two ext4 parsing flaws, and a PE virtual-size integer overflow in the EFI loader.
- [RogueProvision: A SYSTEM Task That Applies Unsigned Provisioning Packages — admin to SYSTEM, declined by MSRC](https://y637f9qq2x.com/posts/rogueprovision/): A SYSTEM service applies unsigned .ppkg packages from a folder — no signature, no consent. Microsoft’s docs promise otherwise. Honest catch: admin→SYSTEM.
- [Rebuilding a Security Researcher’s Mind in an AI — the Method, the Rig, and What It Cannot Do Yet](https://y637f9qq2x.com/posts/researchers-mind-in-ai/): Building an AI that reverse-engineers undocumented Windows internals and raises its own hypotheses. The method, the rig, and the limit it has not crossed.
- [Same Workflow, New Target: AI-Assisted Discovery of CVE-2026-29004 in BusyBox](https://y637f9qq2x.com/posts/cve-2026-29004/): How the AI workflow that found a strongSwan zero-day discovered a 9-year-old heap overflow in BusyBox’s DHCPv6 client, plus a full PoC walkthrough.
- [Finding a 15-Year-Old Zero-Day in strongSwan with AI-Assisted Code Analysis](https://y637f9qq2x.com/posts/cve-2026-25075/): How I discovered CVE-2026-25075, a bug hiding in strongSwan since 2010, using a structured multi-pass AI analysis workflow.

## Full text

- [All articles as markdown](https://y637f9qq2x.com/llms-full.txt): Every published article, complete, in one document — no page chrome, no navigation.

## Findings

- [Findings](https://y637f9qq2x.com/findings/): The CVE IDs from this research, grouped by target area. Each entry is one weakness that is now fixed.

## About

- [Whoami](https://y637f9qq2x.com/whoami/): Kazuma Matsumoto, the research focus, and the coordinated-disclosure policy this site follows.

## Feeds

- [RSS](https://y637f9qq2x.com/rss.xml): One item per article — title, summary, tags and dates. Not the article text.
- [Sitemap](https://y637f9qq2x.com/sitemap-index.xml): XML sitemap.