[CVE-YYYY-NNNNN] — [Vulnerability Title]

One paragraph describing the vulnerability: what component is affected, what kind of bug it is, what an attacker can achieve, and the prerequisites for exploitation. Keep this readable by non-experts.

Explain the subsystem or feature the bug lives in. Cover any protocol, file format, or framework concept the reader needs to follow the rest of the writeup. Include diagrams or pseudo-code when helpful.

Walk through the vulnerable code path. Quote upstream source with file/line references. Identify exactly which assumption is violated and why the bug class applies (CWE).

int parse_packet(const uint8_t *buf, size_t len) {
    uint16_t n = read_be16(buf);           // attacker controlled
    uint8_t  out[256];
    memcpy(out, buf + 2, n);               // ❌ no bound check vs sizeof(out)
    return handle(out, n);
}

• Identify the CWE (e.g. CWE-787 out-of-bounds write)
• Explain the developer assumption that fails
• List preconditions an attacker must satisfy

A minimal PoC that triggers the bug deterministically. Include the exact payload, the expected crash/observation, and the environment it was tested on.

#!/usr/bin/env python3
import socket, struct

HOST, PORT = "127.0.0.1", 4444
payload = struct.pack(">H", 0xFFFF) + b"A" * 0x400

with socket.create_connection((HOST, PORT)) as s:
    s.sendall(payload)
    print(s.recv(1024))

From crash to control: describe primitives gained, mitigations bypassed (ASLR, DEP, CFI, sandbox), and the final impact (RCE, LPE, info-leak, DoS). Be explicit about authentication, network reachability, and user interaction requirements.

1. Trigger OOB write to corrupt adjacent heap chunk
2. Hijack vtable pointer of next allocated object
3. Pivot stack into ROP chain via gadget at libfoo+0x1A2C0
4. Call mprotect() then jump to shellcode
5. → Remote code execution as the service user

How defenders can spot exploitation attempts: network signatures, log artifacts, file/registry indicators, or YARA/Sigma rules.

title: Suspicious [Product] Packet Length
detection:
  selection:
    service|equals: '[product]'
    payload_length|gt: 1024
  condition: selection
level: high

How the vendor fixed it and what users should do until they can patch. Diff the fix and verify it actually addresses the root cause.

- memcpy(out, buf + 2, n);
+ if (n > sizeof(out)) return -EINVAL;
+ memcpy(out, buf + 2, n);

• Upgrade to [X.Y.Z+1] or later
• Apply vendor workaround: [config flag / firewall rule]
• Monitor for the IoCs listed above

• → NVD entry: https://nvd.nist.gov/vuln/detail/CVE-YYYY-NNNNN
• → Vendor advisory: [URL]
• → Upstream commit / patch: [URL]
• → Related research / prior art: [URL]