About me

About me

I am Adrian Junge (vurlo). I started programming in school, and back then I could not have imagined how deep that rabbit hole would go. My first deeper technical interest was algorithms, competitive programming, and the occasional LeetCode problem. Over time that problem-solving curiosity pulled me further into cybersecurity. Today I study computer science at Karlsruhe Institute of Technology (KIT) with a focus on cybersecurity, work in applied computer science at FZI Forschungszentrum für Informatik, and play CTFs as part of KITCTF, the university's CTF team. Lately, I have been digging deeper into bug bounty work, coordinated disclosure, and CVE hunting.

This page is meant as a record of what I have worked on and learned from: reproduced bugs, writeups, disclosures, certificates, and a few milestones along the way.

26 CVEs 1 Bug bounties 2 Created CTF Challenges 1 Certificates 5 Talks 11 Achievements

CVEs

26 entries

FFmpeg

High CVE-2026-70628 CWE-190 CWE-787 DVB subtitle parser heap buffer overflow via WTV file

Summary

FFmpeg 0.5 through versions before 9.0 contained a signed integer overflow in the DVB subtitle parser. A crafted WTV file could wrap the capacity check and make memcpy() write attacker-controlled data beyond a heap buffer, potentially causing memory corruption or code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

Moderate CVE-2026-70629 CWE-908 Uninitialized heap memory read in the RSCC decoder

Summary

FFmpeg 3.0 through versions before 9.0 failed to validate that an RSCC tile decompressed to its declared size. The decoder could copy the unwritten suffix of a persistent heap buffer into the output frame, disclosing data from prior allocations or previously decoded frames.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

Moderate CVE-2026-70630 CWE-908 Uninitialized heap memory read in the Screenpresso decoder

Summary

FFmpeg 3.0 through versions before 9.0 did not verify that an SPV1 packet's Zlib stream produced a complete frame. Copying the full dimensions from the partially written persistent buffer could expose stale heap contents from earlier allocations or frames.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

Moderate CVE-2026-70631 CWE-908 Uninitialized heap memory read in the TIFF decoder

Summary

FFmpeg 0.5 through versions before 9.0 copied every declared TIFF strip row even when Deflate produced fewer bytes than required. The decoded image could consequently contain unwritten bytes holding sensitive data from prior heap allocations.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High CVE-2026-70632 CWE-787 Heap out-of-bounds write in the CFHD decoder via AVI demuxing

Summary

FFmpeg 4.4 through versions before 9.0 failed to enforce the CFHD transform-type-2 output-width invariant. A crafted AVI file could make reconstruction write oversized sample rows beyond the output frame, enabling heap corruption and potentially arbitrary code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

SuiteCRM

High CVE-2026-69142 CWE-89 Authenticated SQL injection in the map_markers distance parameter

Summary

SuiteCRM through 7.15.1 and 8.10.1 inserted the authenticated map marker endpoint's distance parameter into a SQL expression without numeric validation or parameterization. Attackers could use blind SQL injection to extract or manipulate database data and, with sufficiently privileged MySQL deployments, potentially execute code through SELECT INTO OUTFILE.

References

Disclosure timeline

  1. Reported the vulnerability to SuiteCRM.
  2. Report acknowledged by SuiteCRM.
  3. Report accepted by SuiteCRM.
  4. CVE assigned and security advisory published.

FFmpeg

High CVE-2026-66036 CWE-122 Heap out-of-bounds write in the vf_hqdn3d video filter

Summary

FFmpeg through 8.1.2 allocated vf_hqdn3d line-history buffers using the initial frame dimensions. If a crafted video increased its resolution while filtergraph reinitialization was disabled, denoise_spatial() could write beyond those undersized buffers and corrupt heap memory.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High CVE-2026-66037 CWE-770 Uncontrolled resource consumption in the IAMF demuxer

Summary

FFmpeg through 8.1.2 trusted an attacker-controlled count_label value before checking the available IAMF OBU data. A 17-byte input could consequently trigger a multi-gigabyte allocation during format probing, exhausting process memory or causing an OOM kill.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High CVE-2026-66038 CWE-908 Uninitialized memory disclosure in the LCL/Zlib video decoder

Summary

FFmpeg through 8.1.2 treated a short Zlib decompression as non-fatal in the LCL video decoder. The RGB24 conversion path could then copy uninitialized heap contents into the output frame, potentially exposing allocator data and weakening ASLR in long-lived media services.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High CVE-2026-66039 CWE-190 CWE-122 Integer overflow and heap out-of-bounds write in the MACE6 decoder

Summary

FFmpeg through 8.1.2 could overflow the MACE6 output sample-count calculation when decoding a crafted CAF file. This produced an undersized allocation followed by a heap out-of-bounds write, potentially causing memory corruption, a crash, or code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High CVE-2026-66040 CWE-122 Heap out-of-bounds write in the PNG and APNG eXIf encoder

Summary

FFmpeg through 8.1.2 could underestimate the space required to serialize a crafted PNG eXIf chunk whose IFD entries reused a large value payload. Canonical serialization could then expand beyond the allocation and cause deterministic heap corruption, a crash, or potential code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High CVE-2026-66041 CWE-787 Heap out-of-bounds write in the vf_quirc video filter

Summary

FFmpeg 7.0 through 8.1.2 did not resize the vf_quirc grayscale buffer when input dimensions changed. A crafted PGS/SUP subtitle whose second presentation was larger than its first could therefore overflow the initial allocation and cause heap corruption, a crash, or potential code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High CVE-2026-65703 CWE-787 Out-of-bounds write in the TDSC video decoder

Summary

FFmpeg 2.7 through 8.1.2 reused an undersized reference frame when a crafted AVI file changed dimensions between TDSF frames. The TDSC decoder could consequently write attacker-controlled pixel data beyond the frame buffer, causing heap corruption, a crash, or potential code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High CVE-2026-65704 CWE-787 CWE-191 Out-of-bounds write via the TY demuxer and Shorten decoder

Summary

FFmpeg through 8.1.2 could underflow a packet size while processing a crafted ffconcat file with the -safe 0 flag. The negative size reached memcpy() in the Shorten decoder as a near-SIZE_MAX value, causing out-of-bounds reads and writes, heap corruption, and a potential crash or code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High CVE-2026-65705 CWE-787 CWE-131 Out-of-bounds write in the vf_floodfill video filter

Summary

FFmpeg 3.4 through 8.1.2 sized the vf_floodfill traversal stack from the initial frame dimensions. If a later frame was larger while filtergraph reinitialization was disabled, the filter could push points beyond that allocation, corrupting heap memory and potentially causing a crash or code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

FFmpeg

High CVE-2026-65706 CWE-787 CWE-131 Out-of-bounds write in the vf_swaprect video filter

Summary

FFmpeg 3.0 through 8.1.2 reused a temporary row buffer sized for a one-byte pixel step across every image plane. Processing an odd-width NV12 frame could therefore copy past the heap allocation for its interleaved chroma plane, causing memory corruption, a crash, or potential code execution.

References

Disclosure timeline

  1. Reported the vulnerability to the FFmpeg security team.
  2. Fix pull request created.
  3. Fix pull request merged.
  4. Requested a CVE through VulnCheck.
  5. CVE published.

Joomla CMS

High CVE-2026-48898 CWE-284 Privilege escalation through com_users batch task

Summary

Joomla CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 were affected by an improper access check in the com_users batch task. Authenticated attackers could abuse the batch flow to escalate privileges.

References

Disclosure timeline

  1. Reported to the Joomla Security Strike Team.
  2. Confirmation of the issue and initial patch development.
  3. Fixed in Joomla CMS 5.4.6 and 6.1.1 and CVE assigned.

Joomla CMS

Moderate CVE-2026-35222 CWE-89 Post Authenticated blind SQL injection in com_tags 16 min read

Summary

Joomla CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 were affected by improper validation of order clauses in com_tags. Authenticated attackers could manipulate generated SQL and infer database contents through blind SQL injection.

References

Disclosure timeline

  1. Reported to the Joomla Security Strike Team.
  2. First acknowledgment.
  3. Confirmation of the issue and initial patch development.
  4. Fixed in Joomla CMS 5.4.6 and 6.1.1 and CVE assigned.

Joomla CMS

Moderate CVE-2026-35221 CWE-89 Post Authenticated blind SQL injection in com_finder 16 min read

Summary

Joomla CMS 5.4.0 through 5.4.5 and 6.0.0 through 6.1.0 were affected by improperly constructed filter clauses in the com_finder search query. Authenticated attackers could influence the SQL query and infer database contents through blind SQL injection.

References

Disclosure timeline

  1. Reported to the Joomla Security Strike Team.
  2. First acknowledgment.
  3. Confirmation of the issue and initial patch development.
  4. Fixed in Joomla CMS 5.4.6 and 6.1.1 and CVE assigned.

ChurchCRM

High CVE-2026-39334 CWE-89 Authenticated blind SQL injection in SettingsIndividual.php

Summary

In ChurchCRM 7.0.5, settings input handled by SettingsIndividual.php could be used by an authenticated user to influence a SQL query. The issue enabled blind SQL injection behavior that could expose sensitive database contents.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

ChurchCRM

High CVE-2026-39330 CWE-89 Authenticated blind SQL injection in PropertyAssign.php

Summary

In ChurchCRM 7.0.5, property assignment handling in PropertyAssign.php exposed a blind SQL injection path for authenticated users. Attackers could infer database contents and potentially alter application data through injected SQL.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

ChurchCRM

High CVE-2026-39329 CWE-89 Authenticated blind SQL injection in EventNames.php

Summary

In ChurchCRM 7.0.5, event-name management in EventNames.php exposed SQL injection behavior to authenticated users with access to the affected configuration path. Successful exploitation could expose or modify ChurchCRM database records.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

ChurchCRM

High CVE-2026-39327 CWE-89 Authenticated SQL injection in MemberRoleChange.php

Summary

In ChurchCRM 7.0.5, authenticated users with group and role management privileges could inject SQL through the MemberRoleChange.php role update flow. Depending on deployment configuration, this could provide database read/write access and potential privilege escalation.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

ChurchCRM

High CVE-2026-39326 CWE-89 Authenticated blind SQL injection in PropertyTypeEditor.php

Summary

In ChurchCRM 7.0.5, property type editing in PropertyTypeEditor.php accepted authenticated input that could influence SQL statements. The issue could lead to database compromise, including data extraction or modification.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

ChurchCRM

High CVE-2026-39325 CWE-89 Authenticated blind SQL injection in SettingsUser.php

Summary

In ChurchCRM 7.0.5, user settings handling in SettingsUser.php exposed an authenticated blind SQL injection path. Attackers could infer and extract database data through timing-based or boolean blind SQL techniques.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

ChurchCRM

High CVE-2026-39319 CWE-89 Second-order SQL injection via FundRaiserEditor.php

Summary

ChurchCRM 7.1.2 and earlier allowed stored input from FundRaiserEditor.php to become executable SQL later in the fundraiser workflow. This second-order SQL injection could lead to database compromise once the malicious stored value was processed.

References

Disclosure timeline

  1. Report published to ChurchCRM and initial triage.
  2. GitHub advisory published and CVE assigned.

Bug bounties

1 finding

Firedancer

Medium CWE-617 Race condition in the netshred module

Summary

Before Frankendancer Mainnet v0.910.40000 a race condition in the netshred module could lead to a remotely unauthenticated triggerable Denial of Service.

References

Disclosure timeline

  1. Reported to Immunefi via the Firedancer v1 audit competition.
  2. First acknowledgment.
  3. Confirmation of the issue, initial patch development and acknowledgment that the finding is also valid for the Frankendancer bug bounty program.
  4. Fixed in Frankendancer Mainnet v0.910.40000.
  5. Bounty payout

Created CTF Challenges

2 challenges

Scanwich Station

Hard Web Pwn GPNCTF 2026 Writeup 14 min read

Summary

Hybrid web and pwn challenge about mass assignment, QR-code decoding, signed integer overflow, and GLIBC dynamic symbol poisoning. Published for GPNCTF 2026.

Timeline

  1. Published at GPNCTF 2026.

Smile at me

Hard Web GPNCTF 2025 Writeup 11 min read

Summary

Web challenge about URL parser differentials, strict CSP, and an XS-Leak using Scroll-to-Text Fragment behavior with lazy-loaded images. Published for GPNCTF 2025.

Timeline

  1. Published at GPNCTF 2025.

Certificates

1 certificate

Hack The Box Certified Penetration Testing Specialist

Certificate Post 8 min read

Summary

Completed the HTB CPTS path and passed the practical exam on the first attempt, including a full penetration-test report for the exam environment. The work focused on disciplined enumeration, Active Directory attack paths, web findings, and reproducible reporting.

Timeline

  1. Start of the HTB CPTS path.
  2. Completed the HTB CPTS path and started the practical exam.
  3. Passed the practical exam and earned the HTB CPTS certificate.

Talks

5 talks

Teaching AI to hack Joomla so I can skip my homework

Slides

Summary

How a manual SQLi hunt turned into an AI-assisted Joomla audit and multiple assigned CVEs for a university course.

Timeline

  1. Talk at KITCTF.
  2. Final presentation for the course.
  3. Talk at the OWASP Stammtisch Karlsruhe.
  4. Upcoming: Talk at the BSides Munich.

KITCTF Web Intro

Slides Overview

Summary

Introductory web security talk for KITCTF.

Timeline

  1. Talk at KITCTF.

Relevant achievements

11 events

KITCTF

CTF Team KITCTF

Summary

Selected KITCTF team results across international CTFs and finals qualifiers.

Timeline

  1. KITCTF #3 at GlacierCTF 2025 #3 at GlacierCTF.
  2. FluxKITtens #6 at Google CTF 2025 #6 at Google CTF as the FluxKITtens merger team (FluxFingers and KITCTF), qualifying for the Hackceler8 finals in Mexico.
  3. KITCTF #3 at SwampCTF 2025 #3 at SwampCTF.
  4. KITCTF at SnakeCTF 2024 finals Qualified for and participated in the SnakeCTF finals in Italy.
  5. KITCTF #3 at GlacierCTF 2024 #3 at GlacierCTF, qualifying for DHM 2025 as KITCTF team.
  6. KITCTF #1 at SwampCTF 2024 #1 at SwampCTF.

DHM

CTF Competition DHM

Summary

Deutsche Hacking Meisterschaft (CSCG finals).

Timeline

  1. DHM 2025 participation Participated in the DHM finals.
  2. DHM 2024 #1 Placed #1 in the DHM finals.

CSCG

CTF Competition CSCG

Summary

Cyber Security Challenges Germany: Qualified for DHM in 2024 and 2025.

Timeline

  1. CSCG 2025 top 10 global & DHM qualification Qualified for DHM again and finished top 10 globally.
  2. CSCG 2024 DHM qualification Qualified for DHM through CSCG.

Immunefi

Bug bounty Audit Competition Immunefi Bug Bounty Immunefi Audit Competition

Summary

Immunefi bug bounty & audit platform for smart contracts and DeFi projects.

Timeline

  1. Firedancer v1 audit competition Participated in the Firedancer v1 audit competition.