sin99xx.com — /proc/self/maps pc 0x0000000000400000

WARISJEET SINGH

Vulnerability research. Bug bounty. Tooling.

handle sin99xx
region CA
status open
Targets: web, application, virtualization. I find bugs, and build the tooling that finds the next one.

00400000-00400fff r-x .text identity

addr  +0 +1 +2 +3 +4 +5 +6 +7  ascii
0000  77 61 72 69 73 6a 65 65  |warisjee|
0008  74 00 00 00 00 00 00 00  |t.......|
0010  73 69 6e 39 39 78 78 00  |sin99xx.|
0018  ff ff ff ff ff ff ff ff  |........|

00600000-00603fff r-- .rodata disclosures — 7 CVEs, by impact

TargetIDFinding
QEMU VGA CVE-2026-17516
heap OOB write		 Heap out-of-bounds write in the VGA graphics renderer. Patch
QEMU VGA text CVE-2026-77913
OOB write		 Out-of-bounds write in the VGA text renderer after a graphics-mode switch. Fix merged upstream. Patch v3 · 418396be
QEMU CVE-2026-48004
heap UAF		 Heap use-after-free in device emulation — guest-to-host escape primitive. 5a8da7e
Exim CVE-2026-48840
pre-auth leak		 Pre-auth uninitialised stack memory leak in the PROXY-protocol parser. Advisory
QEMU usb-ccid CVE-2026-18204
OOB read		 Out-of-bounds read in the usb-ccid smartcard reader — host heap into guest RAM. Patch
Gemini iOS CVE-2025-5009
info disclosure		 Shared snippet links exposed full conversation history. NVD
Joomla com_modules CVE-2026-48956
access control		 Incorrect access control in com_modules — unprivileged module enumeration. Advisory

00604000-00605000 r-x .plt upstream patches — merged

ProjectChangeFix
Go Google CL 789862
crypto/tls		 Pre-1.3 TLS server handshakes set ConnectionState.LocalCertificate on resumed connections, reporting a chain that was never presented to the peer. Moved population to where the Certificate message is actually written. CL
XNNPACK Google · LiteRT #10464
heap OOB write		 Missing bounds checks in the LiteRT tensor builder let a crafted model drive a heap out-of-bounds write. PR
XNNPACK Google #10463
OOB read		 Out-of-bounds read in the qb4w transposed-weight packer. PR
XNNPACK Google #10373
heap OOB write		 CONCATENATE never checked that inputs matched on non-axis dimensions, so a sibling with a larger trailing product overran the output buffer — attacker-controlled length and content, reachable from an untrusted model through the default float delegate. PR

7ffd2e9df000-7ffd2ea00000 rw- [stack] field record

Accepted findings across public and private programs. One of them against the Bugcrowd platform itself.
#2KOHO leaderboard
#3major private program

1win / DoorDash / Monero / Whoop / Eightfold / private programs