/
← Voltar ao feed
low

Bright Security launches STAR Fuzzer, agentic fuzzing tool that found 10 bugs in 8 open-source projects

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 14:11 · coletado há 2 dias

Bright Security announced the launch of STAR Fuzzer, an agentic fuzzer in its Bright STAR platform. It uses AI to select security-critical functions and generate harnesses, then runs an evolutionary search engine to find faults and delivers byte-exact reproducing payloads. In pre-release testing, 45% of the open-source projects tested had High or Critical issues. In its first month it produced ten published findings across eight projects, including the Crystal standard library, htop, RIOT OS, TwelveMonkeys, Fider, libsolv, universal-ctags and scrimage. The article is vendor marketing, but it discloses several fixed vulnerabilities and two CVEs.

Detalhes técnicos

  • TwelveMonkeys DDS reader: uncapped array sized by mipMapCount, so a 38-byte file forces a multi-gigabyte allocation (CWE-789). GHSA-fwp7-38wp-mmxw, fixed in 3.15.0.
  • Fider: upload validation checks compressed size, then decodes fully, so a 436 KB PNG expands to about 562 MB. Any authenticated user can trigger it (CWE-409). GHSA-7cw3-7xh9-529r, fixed in 0.38.0.
  • Crystal XML::Node#namespace type confusion (CWE-843), GHSA-c267-9cqj-hv9f, and YAML::Any#hash stack overflow via an alias cycle (CWE-674), GHSA-fj8w-2r88-5v7w. Both fixed in Crystal 1.21.1.
  • libsolv: CVE-2026-104621 and CVE-2026-104622, details under embargo.
  • htop: out-of-bounds read in the /proc/PID/stat parser (CWE-125), fixed (#2101).
  • universal-ctags: null-pointer access in foreachEntriesInScope (CWE-476), fixed in commit 780bd7a.
  • scrimage: uncapped pixel count lets a 35-byte GIF trigger allocation of about 2 GB or more (CWE-789), fixed in 4.6.8.
  • RIOT OS: off-by-one in _dirlist_cb (CWE-193), fix submitted in PR #22879.
  • The tool needs no running application and supports C/C++, Rust, Go, Java/Kotlin, .NET, Node, Python and Crystal.

Remediação

Update affected projects to the fixed versions listed: TwelveMonkeys 3.15.0, Fider 0.38.0, Crystal 1.21.1, scrimage 4.6.8, and current htop and universal-ctags builds. Track the libsolv CVEs until the embargo lifts. Consider fuzzing parsers and untrusted-input code paths in CI.

Linha do tempo

  1. gbhackers.com ↗ · pub. 19/10/2026 14:11 · coletado 19/10 17:54 primeiro registro

    Bright Security launches STAR Fuzzer, agentic fuzzing tool that found 10 bugs in 8 open-source projects

    ler a análise desta fonte

    Bright Security announced the launch of STAR Fuzzer, an agentic fuzzer in its Bright STAR platform. It uses AI to select security-critical functions and generate harnesses, then runs an evolutionary search engine to find faults and delivers byte-exact reproducing payloads. In pre-release testing, 45% of the open-source projects tested had High or Critical issues. In its first month it produced ten published findings across eight projects, including the Crystal standard library, htop, RIOT OS, TwelveMonkeys, Fider, libsolv, universal-ctags and scrimage. The article is vendor marketing, but it discloses several fixed vulnerabilities and two CVEs.

    Technical Details

    • TwelveMonkeys DDS reader: uncapped array sized by mipMapCount, so a 38-byte file forces a multi-gigabyte allocation (CWE-789). GHSA-fwp7-38wp-mmxw, fixed in 3.15.0.
    • Fider: upload validation checks compressed size, then decodes fully, so a 436 KB PNG expands to about 562 MB. Any authenticated user can trigger it (CWE-409). GHSA-7cw3-7xh9-529r, fixed in 0.38.0.
    • Crystal XML::Node#namespace type confusion (CWE-843), GHSA-c267-9cqj-hv9f, and YAML::Any#hash stack overflow via an alias cycle (CWE-674), GHSA-fj8w-2r88-5v7w. Both fixed in Crystal 1.21.1.
    • libsolv: CVE-2026-104621 and CVE-2026-104622, details under embargo.
    • htop: out-of-bounds read in the /proc/PID/stat parser (CWE-125), fixed (#2101).
    • universal-ctags: null-pointer access in foreachEntriesInScope (CWE-476), fixed in commit 780bd7a.
    • scrimage: uncapped pixel count lets a 35-byte GIF trigger allocation of about 2 GB or more (CWE-789), fixed in 4.6.8.
    • RIOT OS: off-by-one in _dirlist_cb (CWE-193), fix submitted in PR #22879.
    • The tool needs no running application and supports C/C++, Rust, Go, Java/Kotlin, .NET, Node, Python and Crystal.

    Remediation

    Update affected projects to the fixed versions listed: TwelveMonkeys 3.15.0, Fider 0.38.0, Crystal 1.21.1, scrimage 4.6.8, and current htop and universal-ctags builds. Track the libsolv CVEs until the embargo lifts. Consider fuzzing parsers and untrusted-input code paths in CI.