Vulnerability REsearch

See how LLMs perform UEFI vulnerability discovery with VulHunt, finding known flaws in compiled firmware and 87 candidates in a flagship device.

How U-Boot SPL vulnerability during FIT image processing enabled controlled code execution, exposed configuration-specific risks, and led to stronger boot protections.

Learn how to detect U-Boot vulnerabilities at scale by extracting raw bootloaders, reconstructing synthetic ELF binaries, and applying heuristic-based VulHunt rules that work without symbols or signatures. This deep dive covers firmware extraction, architecture recovery, ELF transformation, and scalable vulnerability detection across real-world embedded devices.

The Binarly Research team has identified six new security vulnerabilities within U-Boot’s FIT (Flattened Image Tree) Signature Verification mechanism, a critical component for maintaining the Root of Trust in firmware. These flaws, affecting stable releases dating back to v2013.07, range from denial-of-service (DoS) conditions to potential arbitrary code execution during the processing of untrusted FIT images. This blog post details the technical nature of these vulnerabilities, demonstrating how they can be exploited, and discusses the coordinated disclosure process with the U-Boot maintainers that resulted in upstream patches. Understanding these risks is essential for firmware security, as compromising the initial bootloader can bypass security checks for all subsequent stages of the boot chain.

Binary patch validation helps identify patched and vulnerable code directly in compiled binaries, reducing false positives from version checks.

Discover how VulHunt integrates with large language models to enable agentic vulnerability research and dramatically accelerate binary analysis. By exposing VulHunt’s disassembly, IR, and decompiled code representations through an MCP interface, LLMs can dynamically execute analysis queries, trace data flows, and identify vulnerable patterns with minimal human input.

A technical deep dive into VulHunt's architecture and capabilities. We explore how the framework combines intra-procedural dataflow analysis, semantic code pattern matching on decompiled output, type libraries, function signatures, annotated code listings, byte pattern matching, and intermediate representation (IR) matching to enable flexible, architecture-aware vulnerability detection in binaries.

We adopt the mindset of a vulnerability researcher and use VulHunt's taint-tracking capabilities to hunt for vulnerabilities in Netgear RAX30 router firmware. From interactive prototyping in the VulHunt shell to building a scalable detection rule, we rediscover CVE-2023-48725 and uncover additional affected binaries — demonstrating VulHunt's full workflow from reconnaissance to automated scanning.

We walk through writing a VulHunt rule to detect CVE-2024-12084, a heap-based buffer overflow in rsync. Starting from understanding the vulnerability's root cause, we build detection logic step by step — covering rule metadata, function scoping, annotation, order guarantees, and decompiler queries — culminating in a production-ready rule that pinpoints the exact vulnerable code path in stripped binaries.

After repeatedly bypassing Supermicro's BMC firmware validation fixes, we detail CVE-2025-12006 and CVE-2025-12007 — the latest in a year-long chain of vulnerabilities that allowed persistent arbitrary code execution through manipulated firmware update images. We walk through each bypass technique, analyze the final patches, and assess whether these critical issues are truly resolved.

Existing tools for checking binaries against known vulnerabilities rely on version strings or simple byte patterns, leading to high false-positive rates and little actionable insight. We built VulHunt to bring code-level, semantic vulnerability detection to binaries — combining dataflow analysis, IR matching, and pattern matching into a single framework that delivers precise, annotated findings at scale.

The software supply chain is complicated, and all the issues associated with it are something we haven't dealt with before and require a different mindset and approach. The vulnerability in Lighttpd was discovered and fixed back in 2018, but a CVE was not assigned to this vulnerability, and a fix was delivered silently by project maintainers. Frequently, the software that uses the open-sourced components does not consume every single update coming from OSS maintainers and only watches the critical changes or important security fixes to apply. In reality, it's hard to track every change for security issues without specific security advisories and CVE assigned.

Software mitigations play a critical role in the quest to secure the digital world. Shortly after the discovery and the rise of buffer overflows in the 90s, mitigations were introduced in the software ecosystem and eventually made their way into virtually any piece of software we run on our devices: from browsers to web servers, from OS kernels to userspace applications. Mitigations are typically designed to address one or more classes of vulnerabilities, making their exploitation more difficult. For example, while exploiting a stack overflow without any deployed mitigation is straightforward, the presence of properly implemented stack canaries requires chaining additional vulnerabilities or leveraging more complex techniques to bypass this protection.

In a previous blog post, we detailed three Supermicro BMC firmware vulnerabilities that were originally found by the NVIDIA Offensive Security Research Team and disclosed earlier this year. All these issues were related to the BMC firmware update process and could be exploited by an attacker with administrative access to the BMC operating system who uploaded a specially crafted image.

Binarly, the industry leader in software and firmware supply‑chain security, will take the keynote day stage at LABScon for the fourth year in a row, reinforcing the company's role as a go-to source for groundbreaking technical research at one of the cybersecurity industry's premier conferences. This year's presentation, Signed and Dangerous: BYOVD Attacks on Secure Boot, presents the first large-scale census of signed UEFI modules, drawn from both public threat intelligence feeds and Binarly's private telemetry.

Binarly REsearch has investigated alarming vulnerabilities in Supermicro BMC firmware, including a critical signature verification bypass (CVE-2024-10237). These issues provide attackers persistent control beneath the OS level.

Binarly's new patent enables environment-aware vulnerability reachability analysis, improving real-world exploitability insights.

Binarly uncovers CVE-2025-3052: a Secure Boot bypass affecting most UEFI devices, enabling attackers to run unsigned code before OS load.

Microcode has always been a crucial component in platform security for the x86 ecosystem. Any vulnerability in microcode leads to significant issues and long-standing side effects across the entire industry. Last week, we witnessed a rare instance of such a vulnerability highlighting potential gaps in AMD's product security practices, prompting industry-wide discussion on the security implications for confidential computing.

Binarly researchers find a direct connection between the newly discovered Bootkitty Linux bootkit and exploitation of the LogoFAIL image parsing vulnerabilities reported more than a year ago.

This vulnerability got our attention for many reasons: firstly, the vendor agreed on the critical impact; and secondly, the nature of the vulnerability where an unauthenticated user can remotely trigger the code flow with a simple post request and cause the arbitrary code execution over classical stack overflow (CWE-121).

Ars Technica reports on the previously underestimated scope of PKfail.

PCWorld reports on the expanding scope of the PKfail vulnerability.

After discovering PKFail, the Binarly REsearch team went on the hunt for other instances of non-production test keys being used in firmware binaries. In this case, non-production test keys were originally generated by reference implementation vendors sitting at the top of the supply chain and then propagated to downstream vendors which often failed to replace them.

Continued press coverage of PKfail vulnerability prevalence.

Press coverage of PKfail vulnerability persistence two months after disclosure.

Binarly will present significant new insights into the critical PKfail vulnerability at this week's LABScon 2024 conference. The research will be presented by Binarly founder and CEO Alex Matrosov, alongside vulnerability research lead, Fabio Pagani.

In this blog, we dive deeper into newly discovered data points gathered from our free detection service pk.fail and major vendor acknowledgements and developments since the initial disclosure of PKfail in July.

Ars Technica coverage of PKfail affecting hundreds of device models.

This report provides technical details on the PKfail vulnerability, its widespread impact spanning over a decade, detection methods, and recommendations for affected users to update firmware or re-key their systems.