Day 2 wraps up with another success! Tanguy Dubroca (@SidewayRE) from Synacktiv (@Synacktiv) used an incorrect pointer scaling leading to privilege escalation on Ubuntu Desktop. They earn $30,000 and 3 Master of Pwn points. #P2OVancouver#Pwn2Own
🔥 Excited to announce our keynote!
We are thrilled to welcome Bruce Dang (@brucedang) and Thai Duong (@XorNinja) from @calif_io! With all their recent AI buzz, we had to check they aren't just LLMs in a trench coat. 🤖🧥
🎟️ Ticketing opens this Thursday at 2:00 PM CEST ⏰
Patch your Linux boxes!
https://t.co/VWOUDbLAn2 is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms.
Found by the teams at @theori_io and @xint_official
More details below
https://t.co/9f6T96PvPX
I discovered a race-based vulnerability class in the Linux kernel: "Out-of-Cancel"
A structural flaw where cancel_work_sync() is used as a barrier for object lifetime management, causing UAF across multiple networking subsystems.
I wrote an exploit for CVE-2026-23239 (espintcp). It interleaves Delayed ACK timers, NET_RX softirqs, timerfd hardirqs, workqueue scheduling, and CFS scheduler manipulation to hit a ~Xµs race window.
Blog: https://t.co/980Iv9t4wE
This is the race scenario diagram 😁:
Deep dive into the provisionning an on-prem low-privileged #LLM stack, with air-gapped networking and GPU-isolation, hardened down to kernel modules.
What could possibly go wrong?
Read the full article here: https://t.co/OS4clOUn2N
At #Pwn2Own Berlin 2025, a full exploit chain against VMware Workstation was demonstrated via a heap overflow in the PVSCSI controller.
Despite Windows 11 LFH mitigations, advanced heap shaping and side-channel techniques enabled a reliable exploit.
🔍 Full technical write-up 👇
https://t.co/R0E5Uqql1E
The a highlight from Day 2 of #Pwn2Own Automotive, the team from @synacktiv is at it again. This time, they leverage NFC(!) to exploit the #Autel MaxiCharger with a stack-based buffer overflow. Amazing! We've never seen an NFC exploit like this one before.
How was a single heap overflow in an Audible parser enough to compromise an Amazon account? Find out in our latest blog post, in which we break down the Kindle vulnerabilities we reported earlier this year.
https://t.co/v524qgdJca
A technical look at @GrapheneOS Hardened Malloc, a memory allocator designed to mitigate heap corruption vulnerabilities (UAF, overflows) and break common exploit primitives.
Deep dive for security researchers & exploit developers by @iksocin
https://t.co/99v99YQTdO
My new article: "Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel"⚡️
I tell a bug collision story and introduce my pet project kernel-hack-drill, which helped me to exploit the hard bug that received @PwnieAwards 2025
https://t.co/0DJzCJYEfm
Exploit for CVE-2025-27363 on Chrome 113 chrome. This is not a new vulnerability, it was patched in March 2023. This PoC targets only chrome headless mode and i wrote a lot, so i don't know if that it's interesting, the poc is not affected by js sandbox https://t.co/5ntlzkhtZf
The latest Synacktiv Summer Challenge was in 2019, and after 6 years, it's back!
Send us your solution before the end of August, there are skills to learn and prizes to win 🎁
https://t.co/iHwFjcNSk0
Userland iOS aficionados, I released a simple IDA plugin that should improve your Objective-C experience.
For now it removes ARC function calls in decompiled code (eg objc_retain) and helps listing candidate callers to a method. Check it out at https://t.co/SvvIOWarRb
Confirmed! Thomas Bouzerar (@MajorTomSec) and Etienne Helluy-Lafont from Synacktiv (@Synacktiv) used a heap-based buffer overflow to exploit #VMware Workstation. They earn $80,000 and 8 Master of Pwn points - sending the contest to over $1,000,000 total! #Pwn2Own
A successful collision! Corentin BAYET (@OnlyTheDuck) from @Reverse_Tactics used 2 bugs to exploit ESXi, but the Use of Uninitialized Variable bug collided with a prior entry. His integer overflow was unique though, so he still earns $112,500 & 11.5 Master of Pwn points. #Pwn2Own
In iOS 18.4, Apple introduced a bug in dynamic symbol resolutions for some specific exports. @0xf4b took a long journey down a rabbit hole to understand its root cause.
https://t.co/q03QTtw373
Last month @ASU I presented my work on formalizing automated bug discovery, developing a framework to characterize the full spectrum of approaches - from fuzzing to human analysis. I'm sharing my evolving perspective on the fundamental nature of the bug finding problem. Full deck: https://t.co/Tnlr5BTW11
Better late than never... My Hexacon 2023 slides for "Finding and Exploiting an Old XNU Logic Bug" and the exploit code (WITH THE ANIMATED ASCII ART 🥷🔪🍎!!!) are up https://t.co/Z3ktOkj6Gi / https://t.co/aoUQp3czyp
@0x09AL After the first safari -> root chain we landed, I just sat there running it over and over in awe
It’s very difficult to express that feeling, seeing months of complexity compressed down into a single moment….