How a single misplaced free() in Canon's proprietary CPCA protocol turned into a $10,000 remote code execution on a networked office printer — plus my own review of the research.

A review of DMGUARD (USENIX Security 2026), the first runtime defense against physical-page use-after-free across CPU, GPU, and IOMMU translation domains.

Goal: the payoff. Reproduce the full chain from the hijacked file: arbitrary read → KASLR bypass → ROP → root. Series Introduction This is the final part of the three-part series on CVE-2026-4624...

GOAL Understand, from a heap perspective, why the 8-byte write-after-free obtained in Part 1 cannot be exploited with same-cache reuse alone, and how it leads — through a cross-cache attack — to t...

GOAL Help the reader understand why the UAF occurs and how the 8-byte UAF write primitive works. Series Introduction This is the first part of a three-part series analyzing CVE-2026-46242 (Bad...