0x140ce retweeted
Our talk "Dark Corners: How a Failed Patch Left VMware ESXi VM Escapes Open for Two Years" has been accepted by BlackHat USA 2025!
Super excited to present this work with @0x140ce and @ezrak1e. See you at #BHUSA! @BlackHatEvents
blackhat.com/us-25/briefings…
I am very glad to be the MSRC Q1 top. During this process, the greatest gain for me was discussing with @danis_jiang on how to use LLM to assist in fuzzing and vulnerability discovery.
Congratulations to all the researchers recognized in this quarter’s MSRC 2025 Q1 Security Researcher Leaderboard! Thanks to all the researchers who partnered with us for your hard work and continued dedication to securing our customers.
Learn more in our blog post: msrc.microsoft.com/blog/2025…
We also want to recognize the top 10 researchers in the leaderboard:
1. 0x140ce (@0x140ce)
2. VictorV (@vv474172261)
3. Vaisha Bernard of Eye Security
4. Wkai
5. Li Shuang and willJ
6. Brad Schlintz (@nmdhkr)
7. Zhiniang Peng with HUST & R4nger with CyberKunLun (@R4nger99) (@edwardzpeng)
8. Anonymous
9. Anonymous
10. Nan Wang (@eternalsakura13)
Escape from VMware ESXi’s vm with my teammates
@danis_jiang Jiang and @ezrak1e.
Successfully bypassing the ArrayBuffer isolation in Adobe Reader and completing the fullchain with @ezrak1e, I will have the opportunity to share with how to perform heap layout under ArrayBuffer isolation and how my vul can reuse the ArrayBuffer as an arbitrary R/W primitive.
