https://arielkoren.com/ Ariel Koren - security research, AI systems, product architecture, and secure systems design. en Wed, 17 Jun 2026 14:51:20 GMT https://arielkoren.com/writing/agentic-boundaries/ https://arielkoren.com/writing/agentic-boundaries/ Wed, 10 Jun 2026 00:00:00 GMT A language model predicts; an agent acts. Why agent authority belongs in a deterministic enforcement layer outside the model - not in the model itself. https://arielkoren.com/writing/omniboard/ https://arielkoren.com/writing/omniboard/ Wed, 13 May 2026 00:00:00 GMT A founder write-up on OmniBoard, the board game console I shelved when 20 flexible color e-ink cards drove the BOM north of $600. What I built, what killed it. https://arielkoren.com/vulnerabilities/cve-2026-48029/ https://arielkoren.com/vulnerabilities/cve-2026-48029/ Sat, 02 May 2026 00:00:00 GMT A single afternoon of fuzzing against libheif 1.21.2 produced two memory-safety bugs in the same function. The first is a NULL pointer dereference on a malformed grid dimg reference - deterministic denial of service on any consumer that calls heif_decode_image or heif_image_handle_decode_image_tile. The second is a uint32 underflow in the inverse-rotation tile arithmetic that feeds a debug-only assert in the grid index lookup; in NDEBUG release builds (the configuration typical distribution packages use) the assert is compiled out and the access becomes a heap out-of-bounds read with an attacker-influenced offset. Disclosed privately to the maintainer on 2026-05-02 and fixed in libheif 1.22.0, released 2026-05-19. Tracked as GHSA-6x5f-qchq-cxqv and assigned CVE-2026-48029. https://arielkoren.com/archive/forging-malicious-doc/ https://arielkoren.com/archive/forging-malicious-doc/ Thu, 24 Dec 2020 00:00:00 GMT Walkthrough of a maliciously crafted Office document that evaded every static engine on VirusTotal — and what the engines were missing. https://arielkoren.com/vulnerabilities/cve-2020-1321/ https://arielkoren.com/vulnerabilities/cve-2020-1321/ Thu, 30 Jan 2020 00:00:00 GMT A grammar-driven .glb fuzzing campaign found a memory-corruption bug in the shared 3D parser used by Microsoft Word and the Microsoft 3D Viewer. The same input crashed both products at matching call-site offsets. Reported to the Microsoft Security Response Center on January 30, 2020. Microsoft published the fix on June 9, 2020 as the Microsoft Office Remote Code Execution Vulnerability, graded Important, CVSS 7.8, exploitation less likely. https://arielkoren.com/archive/fusion-level-06-solution/ https://arielkoren.com/archive/fusion-level-06-solution/ Tue, 14 Nov 2017 00:00:00 GMT Walkthrough and exploit for Level 06 of the Fusion exploitation series. Race conditions, integer overflow, stack overrun. https://arielkoren.com/archive/fusion-level-05-solution/ https://arielkoren.com/archive/fusion-level-05-solution/ Wed, 14 Jun 2017 00:00:00 GMT Solution for Level 05 of the Fusion series. Heap spraying, info leak, and ASLR bypass. https://arielkoren.com/archive/nymaim-deep-technical-dive/ https://arielkoren.com/archive/nymaim-deep-technical-dive/ Wed, 02 Nov 2016 00:00:00 GMT Deep technical dive into the Nymaim banking trojan: anti-analysis tricks, control-flow obfuscation, and the parts that fight back. https://arielkoren.com/archive/ursnif-malware-deep-technical-dive/ https://arielkoren.com/archive/ursnif-malware-deep-technical-dive/ Tue, 01 Nov 2016 00:00:00 GMT Reverse-engineering walkthrough of Ursnif: process injection, sandbox evasion, traffic obfuscation, and a bug in the malware's own DGA.