# Ariel Koren

> Ariel Koren is a security researcher working across vulnerability research, CVEs and 0days, AI and agentic security, browser security, reverse engineering, and secure systems and product architecture. This site is a curated technical archive of that work.

Ariel has been CTO and co-founder of a security startup (SNDBOX), discovered and responsibly disclosed CVEs, and writes long-form technical essays on agent security and systems design.

## Key pages

- [About](https://arielkoren.com/about/): Professional narrative: security research, systems design, and the throughline between them.
- [Work](https://arielkoren.com/work/): Archive of selected work across security research, systems, and startups.
- [Contact](https://arielkoren.com/contact/): How to reach Ariel for technical collaboration, research, and advising.
- [FAQ](https://arielkoren.com/faq/): Answers about Ariel Koren: background, CVEs, SNDBOX, Anvil, and how to collaborate.

## Writing

- [Skia RenameFont OOB. Google Won't Fix It.](https://arielkoren.com/writing/skia-renamefont/): A verified heap out-of-bounds write in Skia's SkOTUtils::RenameFont via the public GDI font API on Windows - reported, reproduced, declined won't-fix.
- [AI Slop Is a Leadership Problem](https://arielkoren.com/writing/ai-slop-leadership/): AI made execution cheap and direction the bottleneck. Slop is not a model problem - it is what happens to amplified output when nobody owns the direction.
- [Anvil: An Autonomous Vulnerability-Research Platform](https://arielkoren.com/writing/anvil-architecture/): A systems-design writeup of Anvil: how AI agents do the research glue work while schemas, sanitizers, reachability, and an evidence ladder keep the claims honest.
- [LLMs Are Probabilistic. Agent Authority Cannot Be.](https://arielkoren.com/writing/agentic-boundaries/): A language model predicts; an agent acts. Why agent authority belongs in a deterministic enforcement layer outside the model - not in the model itself.
- [OmniBoard: The Board Game Console That Didn't Pencil Out](https://arielkoren.com/writing/omniboard/): A founder write-up on OmniBoard, the board game console I shelved when 20 flexible color e-ink cards drove the BOM north of $600. What I built, what killed it.

## Vulnerability research

- [0day: libpng APNG OOB Write](https://arielkoren.com/vulnerabilities/libpng-apng-write-fuzzing/): A write-side fuzzing campaign against libpng18's APNG re-encode path found a per-frame buffer lifecycle bug causing both a memory leak and a width-dependent heap buffer overflow. The overflow carries 100% attacker-controlled bytes, scales linearly with canvas width to a per-row ceiling of approximately 4 MB at libpng's default user-width limit, and was characterized in a no-ASAN glibc test build as an input-controlled adjacent-heap overwrite. Patch authored and validated across a multi-billion-execution post-discovery campaign.
- [Finding CVE-2020-1321: Fuzzing Microsoft Office's 3D Model Parser](https://arielkoren.com/vulnerabilities/cve-2020-1321/): A grammar-driven .glb fuzzing campaign found a memory-corruption bug in the shared 3D parser used by Microsoft Word and the Microsoft 3D Viewer. The same input crashed both products at matching call-site offsets. Reported to the Microsoft Security Response Center on January 30, 2020. Microsoft published the fix on June 9, 2020 as the Microsoft Office Remote Code Execution Vulnerability, graded Important, CVSS 7.8, exploitation less likely.
- [CVE-2026-48029: Two Grid-Decode Vulnerabilities in libheif](https://arielkoren.com/vulnerabilities/cve-2026-48029/): A single afternoon of fuzzing against libheif 1.21.2 produced two memory-safety bugs in the same function. The first is a NULL pointer dereference on a malformed grid dimg reference - deterministic denial of service on any consumer that calls heif_decode_image or heif_image_handle_decode_image_tile. The second is a uint32 underflow in the inverse-rotation tile arithmetic that feeds a debug-only assert in the grid index lookup; in NDEBUG release builds (the configuration typical distribution packages use) the assert is compiled out and the access becomes a heap out-of-bounds read with an attacker-influenced offset. Disclosed privately to the maintainer on 2026-05-02 and fixed in libheif 1.22.0, released 2026-05-19. Tracked as GHSA-6x5f-qchq-cxqv and assigned CVE-2026-48029.

## Archive (older technical writeups)

- [Forging malicious DOC, undetected by all VirusTotal static engines](https://arielkoren.com/archive/forging-malicious-doc/): Walkthrough of a maliciously crafted Office document that evaded every static engine on VirusTotal - and what the engines were missing.
- [Fusion - Level 06 solution](https://arielkoren.com/archive/fusion-level-06-solution/): Walkthrough and exploit for Level 06 of the Fusion exploitation series. Race conditions, integer overflow, stack overrun.
- [Fusion - Level 05 solution](https://arielkoren.com/archive/fusion-level-05-solution/): Solution for Level 05 of the Fusion series. Heap spraying, info leak, and ASLR bypass.
- [Nymaim malware: deep technical dive - adventures in evasive malware](https://arielkoren.com/archive/nymaim-deep-technical-dive/): Deep technical dive into the Nymaim banking trojan: anti-analysis tricks, control-flow obfuscation, and the parts that fight back.
- [Ursnif malware: deep technical dive](https://arielkoren.com/archive/ursnif-malware-deep-technical-dive/): Reverse-engineering walkthrough of Ursnif: process injection, sandbox evasion, traffic obfuscation, and a bug in the malware's own DGA.