PixiePoint Security

If you like 0-day and N-day research, we'll love to hear from you! pixiepointsecurity.com/careers/

9% into 2026 and look what @cloudlldb already have... :)

What better way to get into x'mas vibes than @flyingpassword dropping a BFS n-day (CVE-2025-29970) blog post! (Santa would approve :)) Merry X-mas! pixiepointsecurity.com/blog/nday-cve-…

And... hot on the heels will be @voix44er attempting the Philips Hue Bridge this week! All the best and have fun!

Looks like @__neverm0r_ and @b1thvn_ TyphoonPwn entry is patched this month as CVE-2025-55681... thanks @SecuriTeam_SSD for the fun experience!

If u think that Windows research is all we do, think again! In our first IOT blog, @voix44er details the Wolfbox EV charger setup, attack surface, his #Pwn2Own Automotive 2025 bug, exploitation, and best of all, displaying our name on it (in styleee...)! pixiepointsecurity.com/blog/pwn2own-2…

Happy Friday! Our intern, @__neverm0r_ , discovered and reported a NPD due to race-condition in afd.sys. Wasn’t assigned a cve doesn’t mean it’s less interesting, right!? pixiepointsecurity.com/blog/advisory-…

Proud to see @_jaelkoh (with @saidelike) talking about undocumented internals of KTM, the bugs and exploits in 'Hunting for Overlooked Cookies in Windows 11 KTM and Baking Exploits for Them'. No ovens required for this recipe!

Unfortunate, but still a good showing! 🫡

Annnddd... the odds ARE in your favor! Congrats @voix44er ! This result is just the cherry on the cake. Regardless of what it may be, what we don't see is the dedication and hard work put into the research.. 💪💪💪

Hello world! First post in 2025; @voix44er attempting to pwn WolfBox EV charger at #P2OAuto on Day 2. “May the odds be ever in your favor”!

@b1thvn_ did this for fun… POC for CVE-2024-38106 pixiepointsecurity.com/blog/nday-cve-…

Sometimes your past has a way of sneaking up/"garbage-collecting" on you.. Well done @b1thvn_, and thanks @TheZDIBugs for tracking these zerodayinitiative.com/advisories/ZDI… zerodayinitiative.com/advisories/ZDI…

Credit: Dewang Ahluwalia

All shells are spawned equal, regardless of memory-corruption bugs or not! CVE-2021-34462: Exploiting the Windows AppXSvc Service Logic-Error Vulnerability pixiepointsecurity.com/blog/nday-cve-…

Credit: Wei Lei

New year, new blog post! CVE-2021-31985: Exploiting the Windows Defender AsProtect Heap Overflow Vulnerability pixiepointsecurity.com/blog/nday-cve-…

Corrected url: googleprojectzero.github.io/0days-in-the-w…

Props to @maddiestone for maintaining this ITW RCA program :)

As it is confirmed to be the ITW CVE-2022-24521, we also contributed the content to GP0 for interested folks googleprojectzero.github.io/0days-in-the-w…

RCA for 1 of the 2 CLFS bugs patched in April 2022. While we can't determine the CVE, we did managed to exploit it ;) ... credit: @b1thvn_ pixiepointsecurity.com/blog/nday-cve-…