---
name: memory-corruption-and-native-code
description: "Guides a reviewer or AI agent through auditing native and memory-unsafe code for corruption, sandbox escape, and privilege-escalation weaknesses on an authorized target."
---

# Memory corruption and native code

Browsers, kernels, hypervisors, desktop and mobile apps, native libraries: memory-safety bugs, sandbox escapes, native parsing.

_From Bug Bounty Library (https://bugbountylibrary.com): generated from disclosed, accepted reports and updated as new ones land. Updated 2026-10-23. Tested on 52 newer reports it was not written from: following it finds about 50% of them._

## Approaching memory corruption and native code

Native bugs live where untrusted data meets manual memory management. Work from the attack surface inward: identify every place attacker-controlled bytes, lengths, indices, or handles cross into native code, then trace how they are validated and used.

**Map first**
- Entry points: parsers, IPC endpoints, file formats, URI handlers, webview bridges, syscalls, hypervisor exits.
- Trust boundaries: which fields are attacker-controlled vs. re-derived internally.
- Memory ownership: who allocates, who frees, what holds raw pointers across callbacks, threads, or GC.
- Privilege transitions: sandboxed-to-broker, user-to-kernel, guest-to-host.

**Questions that surface weaknesses**
- Is every length checked against the *actual* destination capacity at the point of use, not earlier?
- Can size arithmetic wrap, truncate, or go negative before allocation or copy?
- Are indices signed, and checked on both bounds?
- Is a type tag or pointer from input revalidated before reinterpretation?
- Can a callback, thread, or GC free an object still held by raw pointer?
- Does a privileged path resolve names through symlinks, search order, or user-writable dirs?
- Are local IPC and loopback services authenticated?
- Does optimized/JIT code trust a cached type after a side effect?

**Using the patterns**
Treat each pattern as a search lens, not a checklist. For a given code path, ask which patterns could apply, then read the code looking for the specific shape: the copy, the allocation, the index, the free, the path join. Confirm the missing check exists at the use site. Note the trigger, the boundary crossed, and the impact. Prioritize paths reachable from untrusted input with privilege or sandbox implications.

## Patterns

Each pattern below has a full write-up (how it works, where it shows up, how to review for it, variants, impact), grounded in
real disclosed reports. Load the one you need from its link.

### Integer overflow in allocation size
Input-derived size arithmetic that wraps before allocation while the copy uses the true length

_32 reports · 15 confirmed bounties, median $500, up to $7,500._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/integer-overflow-allocation-size.md

### Unbounded copy into fixed buffer
Copy length or source exceeds destination capacity; check every copy, expansion, and decode against the buffer it writes into

_28 reports · 14 confirmed bounties, median $1,068, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/fixed-buffer-unbounded-copy.md

### Signed index missing lower bound
Signed index or class id checked on one side only, then used to index an array or bitmap

_17 reports · 11 confirmed bounties, median $1,000, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/signed-index-bounds.md

### Type confusion via trusted tag
Caller-supplied tag or type field used to reinterpret memory without revalidation

_13 reports · 4 confirmed bounties, median $4,250, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/type-confusion-variant-tag.md

### Integer truncation of length fields
A wide length narrowed to a smaller or signed type before allocation, bounds check, or copy

_12 reports · 5 confirmed bounties, median $1,000, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/integer-truncation-size.md

### Unchecked parser offset or index
Input-derived index, offset or length used to address memory without a bound check at the point of use

_12 reports · 6 confirmed bounties, median $4,750, up to $75,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/parser-offset-index-unchecked.md

### Use-after-free via callback reentrancy
Raw pointer or index held across a callback that can free or reallocate the same object

_12 reports · 6 confirmed bounties, median $2,200, up to $5,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/use-after-free-callback-reentrancy.md

### Race frees in-use object
Unlocked hash, refcount or GC path frees a struct another thread still reads

_12 reports · 5 confirmed bounties, median $10,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/use-after-free-race-free.md

### Premature length uninitialized memory disclosure
Length or size set before the write, or requested size used instead of bytes actually written

_11 reports · 2 confirmed bounties: $8,000 and $80,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/uninitialized-memory-disclosure.md

### DLL search order hijack
Privileged process loads unqualified library or config from a directory a normal user can write

_11 reports · 8 confirmed bounties, median $250._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/dll-search-order-hijack.md

### Symlink redirect of privileged file operation
Privileged delete, write, or move resolving a path through a symlink, junction, or reparse point

_10 reports · 5 confirmed bounties, median $250, up to $30,500._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/symlink-junction-redirect.md

### Unsanitized argument command injection
Attacker string reaching a shell, argv, URI handler, or OS-open call without quoting or allowlisting

_10 reports · 4 confirmed bounties, median $6,250, up to $8,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/command-injection-unsanitized-arg.md

### VM register type confusion
Interpreter opcodes and C helpers dereferencing registers or immediates as heap objects without a runtime type check

_9 reports · 9 confirmed bounties, median $8,000, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/vm-register-type-confusion.md

### Negative size to memcpy/memset
Signed or wrapped length reaching a copy, fill, or offset without a non-negative and capacity check

_9 reports · 6 confirmed bounties, median $500, up to $40,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/negative-size-memcpy.md

### Dangling pointer in stale cache
Cached pointer or metadata outlives its freed, moved, or replaced target, then gets dereferenced

_8 reports · 3 confirmed bounties, median $5,000, up to $22,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/dangling-pointer-stale-cache.md

### Unchecked failure return or unset value dereferenced
Helper failure returns, skipped init, or absent optional fields used without a check before dereference

_8 reports · 2 confirmed bounties: $500 and $8,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/null-deref-unchecked-native-return.md

### JIT stale map type assumption
Optimized code keeps a cached map or field type after a mutation path fails to deoptimize it

_7 reports · one confirmed bounty: $250,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/jit-type-confusion-stale-map.md

### GC-untracked live object freed
Live objects reachable only via callbacks, fibers, ephemerons or plugin fields that the collector fails to mark

_7 reports · 2 confirmed bounties: $300 and $800._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/jit-gc-untracked-reference.md

### Buffer overread information disclosure
Reads past initialized bytes: unterminated strings, delimiter mismatches, unchecked pointer advances, fill-without-terminate

_7 reports · one confirmed bounty: $1,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/info-disclosure-overread.md

### Unchecked parser length arithmetic
Computed lengths/offsets used before checking non-negative, in-range, cursor advanced

_7 reports · 4 confirmed bounties, median $1,250, up to $5,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/unchecked-arithmetic-in-parser-lengths.md

### Uninitialized struct field reachable from input
Fields read before init after removed init, skipped constructor mode, or parser mismatch leaving buffers unset

_7 reports · 5 confirmed bounties, median $8,000, up to $10,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/uninitialized-struct-field-reachable.md

### Off-by-one bounds check
A size check that admits the boundary value, letting one index or one terminator past the end through

_6 reports · 4 confirmed bounties, median $1,400, up to $7,500._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/off-by-one-bounds.md

### Trusted length field drives copy
Length, size, or capacity from input or config used as copy size or loop bound without checking real space

_6 reports · one confirmed bounty: $20,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/trusted-length-field-overflow.md

### Unauthenticated local IPC and loopback APIs
Local services accepting any caller without verifying identity, entitlements, or Host header

_6 reports · 3 confirmed bounties, median $10,000, up to $23,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/auth-bypass-local-ipc.md

### Privileged write to user-writable path
Elevated code writing, loading, or resolving from a location an unprivileged user can control or redirect

_6 reports · 3 confirmed bounties, median $1,250._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/privilege-escalation-writable-path.md

### Parser length/offset mismatch
A length or offset checked in one place but a copy uses a stale or differently-derived value

_5 reports · one confirmed bounty: $40,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/parser-length-mismatch.md

### Async callback outlives captured object
Raw this or raw pointer captured in async task, dispatch, or reply handler with no lifetime guarantee

_5 reports · 2 confirmed bounties: $8,000 and $215,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/use-after-free-async-outlive.md

### Double free on error and cleanup paths
A buffer freed on an error or teardown path without clearing the pointer or its length, then freed again

_5 reports · 2 confirmed bounties: $200 and $1,500._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/double-free-error-path.md

### Privileged write path traversal
User-controlled name joined into a privileged path; check canonicalization vs. how the writer resolves it

_5 reports · 3 confirmed bounties, median $6,000, up to $13,337._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/path-traversal-privileged-write.md

### TOCTOU check-then-use swap
A name or handle validated, then re-resolved or reopened before use, letting content swap in between

_5 reports · 3 confirmed bounties, median $5,000, up to $30,500._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/toctou-check-then-use.md

### Origin leak via navigation and window proxies
about:blank, window proxy, or native UI that copies or trusts origin state across a boundary

_5 reports · 2 confirmed bounties: $2,000 and $3,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/sandbox-escape-origin-bypass.md

### DLL side-loading from writable directory
Signed binary or COM registration loading a library by name from a user-writable or app directory

_5 reports._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/dll-side-loading-from-writable-dir.md

### Fixed stack buffer overflow from count
Attacker-controlled count or length written into a fixed-size stack array without a capacity check

_5 reports · one confirmed bounty: $5,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/fixed-stack-buffer-overflow-from-count.md

### Attacker-controlled index past fixed array
Buffer sized by one count but indexed by another attacker-controlled value; check index against allocation

_5 reports · 3 confirmed bounties, median $1,500._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/attacker-controlled-index-into-fixed-array.md

### Null dereference on malformed input
Lookup, stack pop, or allocation result used without a null check on the malformed-input path

_5 reports · 3 confirmed bounties, median $800, up to $8,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/null-deref-on-malformed-input.md

### Bytecode feedback vector mismatch
Compiler emits bytecode inconsistent with feedback vectors, jump offsets, or opcode dispatch; reparse diverges from first parse

_4 reports · 3 confirmed bounties, median $10,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/bytecode-feedback-mismatch.md

### VM stack pointer corruption
Stack or callinfo pointers held across realloc, negative counts, or unwinding that move them out of bounds

_4 reports · 3 confirmed bounties, median $800._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/vm-stack-pointer-corruption.md

### Presence check without type validation
Lookup proves an object exists, then it is cast or field-accessed without a type tag check

_4 reports · 2 confirmed bounties: $500 and $1,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/type-confusion-presence-not-type.md

### Untrusted pointer dereference in native IPC
Pointers, sizes, or addresses from shared sections or IPC messages reaching memcpy, ComPtr assignment, or indirect calls unvalidated

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/untrusted-pointer-dereference.md

### Webview context isolation and navigation gate gaps
Page JS sharing a realm with native code, or reaching privileged origins through missing navigation gates

_4 reports · 4 confirmed bounties, median $7,500, up to $150,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/sandbox-escape-context-isolation.md

### Kernel access check skipped
Kernel paths opening or pinning objects with privileged access mode or dropped permission flags

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/privilege-escalation-access-mode.md

### Unbounded graph traversal recursion
Traversal or error paths that recurse without visited set, depth limit, or cycle check

_4 reports · 3 confirmed bounties, median $10,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/unbounded-cycle-walk.md

### Stale handle state across reused operations
Reused handles or pooled connections carrying prior per-request state into a new operation

_4 reports · 2 confirmed bounties: $480 and $2,400._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/stale-handle-state-reuse.md

### Unbounded length causes memory exhaustion
Untrusted length or count used directly to allocate, map, copy, or loop without a cap

_4 reports · one confirmed bounty: $2,400._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/unbounded-attacker-length-oom.md

### Unsigned size check wraps to overflow
Unsigned subtraction or comparison in length checks where the operand can be smaller than the constant

_4 reports · one confirmed bounty: $31,337._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/unsigned-size-underflow-wrap.md

### Sandbox escape via privileged proxy
Sandboxed input reaching a privileged proxy that trusts URLs, messages, or class names without revalidation

_3 reports · 5 confirmed bounties, median $3,000, up to $36,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/sandbox-escape-privileged-proxy.md

### Wrong owner SID on privileged object
Kernel or privileged service creates objects under impersonation with wrong owner SID or permissive DACL

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/privilege-escalation-wrong-owner.md

### Unchecked pointer and limb arithmetic
Pointer or limb arithmetic used without wrap or modulus bound before the result is trusted

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/unchecked-arithmetic-on-pointer-or-limb.md

### Untrusted path to executable load
Bare command names, sentinel filenames, or file-format paths that resolve to code execution

_3 reports · 2 confirmed bounties: $750 and $20,000._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/untrusted-path-resolved-to-executable.md

### Signed driver trust bypass
Signature or allowlist checked once, then file, mapping, or name swapped before use

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/signed-driver-trust-bypass.md

### Property interceptor reentrancy corruption
Engine code that runs user JS mid-property-assignment, then trusts a stale lookup result

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/interceptor-reentrancy-corruption.md

### Incomplete elliptic curve point validation
On-curve check skipped or unbound; subgroup/range tests pass for off-curve or inconsistent points

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/memory-corruption-and-native-code/crypto-point-validation-gap.md

## Rarer patterns

Seen only once or twice so far, so there is no full write-up yet; each links to the report that shows it.

- **Dynamic path resolution bypasses normalization**: Path built by dynamic resolver skipping permission or traversal normalization (https://bugbountylibrary.com/r/blog%3Ablog-trailofbits-com-2023-02-21-vscode-extension-escape-vulnerability.md)
- **Mutated offset reused for later writeback**: Parser offset advanced then reused for write, landing data in wrong page (https://bugbountylibrary.com/r/ghsa%3AGHSA-332p-7hrc-92wf.md)
- **Interpreter stack pointer corruption**: Negative counts or crafted nested constructs move VM operand or stack pointers out of bounds (https://bugbountylibrary.com/r/h1%3A212107.md)
- **Negative count underflows pointer**: Signed count used in pointer arithmetic without lower-bound check (https://bugbountylibrary.com/r/p0%3ACVE-2020-27930.md)
- **Opcode offset mismatch in decoder**: Decoder indexes branch or operand fields using wrong opcode class offset (https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.19.md)
- **Prototype pollution reaching native OOB**: Array setters or prototype hooks that expose internal native objects to attacker-controlled writes (https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2022-8-17-but-you-told-me-you-were-safe-attacking-the-mozilla-firefox-renderer-part-1.md)
- **Shift count not masked to width**: Emulator or JIT shift op uses raw count without masking to 5 or 6 bits (https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AM-07.md)
- **Signed content revalidation bypass**: Approved or signed file auto-launched then reopened after content change without revalidation (https://bugbountylibrary.com/r/blog%3Aryanpickren-com-safari-uxss.md)
- **Weak PRNG seed and nonce reuse**: Key generation seeded with time or skipping regeneration when key already set (https://bugbountylibrary.com/r/h1%3A2038484.md)