nandsec
Research2 reported upstream

nandsec is focused on vulnerability research into memory safety and exploitation, operating system security, software security, malware analysis, firmware and AI agents.

We research and analyse offensive tactics, techniques and procedures (TTPs) to understand how the modern adversary operates, and design stronger defences into the modern computing stack. We work with our industry peers to upstream patches for the vulnerabilities we find, and publish our findings once the fix ships.

Day 90 of 90Disclosure period over

day 90 ยท Period ends The latest date for the blog post if no fix ships. Extensions may be agreed if a fix is near release.

Reported upstream

2 of 2 fixed

Bugs we have reported to open-source projects, with the status of each fix.

2026-10-27Linux kernel, snd-usb-audio A USB packet larger than the PCM ring buffer causes an out-of-bounds access, in capture and playback.Fixed 2026-10-27Linux kernel, snd-ua101 The same out-of-bounds access in the UA-101 driver.Fixed

Focus areas

The subjects we research and publish on.

Memory safety and exploit mitigation
How memory corruption bugs are exploited, and the defences that stop them: memory tagging, control-flow integrity and hardened allocators.
Operating system security
Kernel, boot and user-space security, and the isolation between processes, containers and sandboxes.
Malware and threat research
Reverse engineering malware and the techniques used against Australian organisations, published with vendor-neutral detection logic.
Embedded devices and firmware
Boot chains, update mechanisms and firmware in the devices businesses run.
Compiled software and the supply chain
Binary analysis of C and Rust, what compilers and build pipelines produce, and whether SBOMs match what ships.
Agentic systems and LLM security
How LLM applications, agents, MCP servers and AI coding tools handle permissions, isolation and untrusted input.
Products used by Australian businesses
The software and hardware that local small and mid-sized businesses depend on, with vulnerabilities disclosed to the vendor.

Publications

Each entry has enough detail for an engineer to reproduce the result.

Bug reports
Bugs reported to open-source projects, with the patch and its status.
Advisories
Vulnerabilities reported to vendors, published once fixed or when the disclosure period ends.
Blog posts
The full analysis behind a bug report or an advisory.
Tools
Code from our research, under an open-source licence.
Talks
Slides and recordings from conferences.

Published

Blog postOperating system security2026-11-04Ring buffer out-of-bounds writes in the Linux USB audio driversIn this post I want to discuss how I found these bugs, how I reproduced them with an emulated USB device, and how I fixed, tested and submitted the patches for both drivers.