# buffer overflow

Published articles for buffer overflow.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices

DevFeed: [Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices](<https://devfeed.tech/articles/mongoose-preauth-rce-and-mtls-bypass-on-millions-of-devices-41273.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2026/04/02/Mongoose-Preauth-Remote-Code-Execution-and-mTLS-Bypass/>)

Author: Simone Margaritelli

Published: 2026-04-01T22:00:00Z

Content type: article

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [Mongoose](<https://devfeed.tech/topics/mongoose.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [Embedded Systems](<https://devfeed.tech/topics/embedded-systems.md>), [Internet of things](<https://devfeed.tech/topics/iot.md>), [C](<https://devfeed.tech/topics/c.md>), [cross-platform](<https://devfeed.tech/topics/cross-platform.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [MQTT](<https://devfeed.tech/topics/mqtt.md>), [WebSocket](<https://devfeed.tech/topics/websocket.md>)

Tags: [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [buffer-overflow](<https://devfeed.tech/tags/buffer-overflow.md>), [c](<https://devfeed.tech/tags/c.md>), [cesanta](<https://devfeed.tech/tags/cesanta.md>), [cross-platform](<https://devfeed.tech/tags/cross-platform.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-5244](<https://devfeed.tech/tags/cve-2026-5244.md>), [cve-2026-5245](<https://devfeed.tech/tags/cve-2026-5245.md>), [cve-2026-5246](<https://devfeed.tech/tags/cve-2026-5246.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [embedded](<https://devfeed.tech/tags/embedded.md>), [embedded-devices](<https://devfeed.tech/tags/embedded-devices.md>), [embedded-systems](<https://devfeed.tech/tags/embedded-systems.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [heap-overflow](<https://devfeed.tech/tags/heap-overflow.md>), [http](<https://devfeed.tech/tags/http.md>), [https](<https://devfeed.tech/tags/https.md>), [industrial-control](<https://devfeed.tech/tags/industrial-control.md>), [iot](<https://devfeed.tech/tags/iot.md>), [iot-security](<https://devfeed.tech/tags/iot-security.md>), [library](<https://devfeed.tech/tags/library.md>), [mdns](<https://devfeed.tech/tags/mdns.md>), [mips](<https://devfeed.tech/tags/mips.md>), [mongoose](<https://devfeed.tech/tags/mongoose.md>), [mqtt](<https://devfeed.tech/tags/mqtt.md>), [mtls](<https://devfeed.tech/tags/mtls.md>), [rce](<https://devfeed.tech/tags/rce.md>), [responsible-disclosure](<https://devfeed.tech/tags/responsible-disclosure.md>), [security](<https://devfeed.tech/tags/security.md>), [stack-overflow](<https://devfeed.tech/tags/stack-overflow.md>), [tls](<https://devfeed.tech/tags/tls.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>)

### AI overview

The article reports three independently exploitable vulnerabilities in Mongoose v7.20, an embedded C networking library used in IoT devices: an mTLS authentication bypass, a preauthentication heap-overflow RCE through client public-key parsing, and a preauthentication RCE through mDNS over UDP. Mongoose v7.21 reportedly includes patches for the issues, which were assigned CVE-2026-5244, CVE-2026-5245, and CVE-2026-5246.

### Source excerpt

So, Mongoose. I

## Run My Code! (code injection on Windows)

DevFeed: [Run My Code! (code injection on Windows)](<https://devfeed.tech/articles/run-my-code-code-injection-on-windows-39725.md>)

Original publisher: [Read original article](<https://www.timdbg.com/posts/run-my-code/>)

Author: Tim Misiak

Published: 2023-08-27T22:13:28Z

Content type: tutorial

Language: en

Sources: [TimDbg](<https://devfeed.tech/sources/timdbg.md>)

Topics: [Code](<https://devfeed.tech/topics/code.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Programming](<https://devfeed.tech/topics/programming.md>)

Tags: [binaries](<https://devfeed.tech/tags/binaries.md>), [buffer-overflow](<https://devfeed.tech/tags/buffer-overflow.md>), [code](<https://devfeed.tech/tags/code.md>), [processes](<https://devfeed.tech/tags/processes.md>), [programming](<https://devfeed.tech/tags/programming.md>), [windbg](<https://devfeed.tech/tags/windbg.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

This article explains code injection on Windows, focusing on ways to run code inside another process without relying on a security vulnerability. It introduces static injection through patching, DLL injection, and dynamic code injection, and discusses drawbacks of modifying binaries on disk, including effects on repeated runs and code signing.

### Source excerpt

The first time I realized it was possible to get a process to run some extra little code I had written, it felt like the ultimate cheat code. My first attempt was a little patch for Civilization 2 to fix some high CPU usage. Then I discovered that you could inject code at run-time. And when I discovered the ability to change how OS functions worked, it started to feel like I could do anything!

## FORTIFY\_SOURCE

DevFeed: [FORTIFY\_SOURCE](<https://devfeed.tech/articles/fortify-source-38928.md>)

Original publisher: [Read original article](<https://idea.popcount.org/2013-08-15-fortify_source>)

Author: Marek

Published: 2013-08-14T22:00:00Z

Content type: tutorial

Language: en

Sources: [Marek Majkowski](<https://devfeed.tech/sources/marek-majkowski.md>)

Topics: [C](<https://devfeed.tech/topics/c.md>), [gcc](<https://devfeed.tech/topics/gcc.md>), [Security](<https://devfeed.tech/topics/security.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Fedora](<https://devfeed.tech/topics/fedora.md>), [Ubuntu](<https://devfeed.tech/topics/ubuntu.md>)

Tags: [buffer-overflow](<https://devfeed.tech/tags/buffer-overflow.md>), [c](<https://devfeed.tech/tags/c.md>), [fedora](<https://devfeed.tech/tags/fedora.md>), [gcc](<https://devfeed.tech/tags/gcc.md>), [linux](<https://devfeed.tech/tags/linux.md>), [performance](<https://devfeed.tech/tags/performance.md>), [protection](<https://devfeed.tech/tags/protection.md>), [security](<https://devfeed.tech/tags/security.md>), [ubuntu](<https://devfeed.tech/tags/ubuntu.md>)

### AI overview

This tutorial explains two GCC security options used by C programmers on Linux distributions: -fstack-protector and -D_FORTIFY_SOURCE=2. It shows how stack canaries detect stack corruption and how fortified buffer functions can help detect some overflows, while noting performance costs and the need for safer coding practices.

### Source excerpt

FORTIFY_SOURCE In recent years Linux distributions started treating security more seriously. Out of many security features two are directly affecting C programmers: and . These GCC options are now enabled by default on Ubuntu and Fedora. What do these options do?