TLDR Tech / InfoSec
Getting a CVE Without Shipping Slop
Jeff Barron describes how he used Claude Code integrated with Ghidra MCP to analyze ASUS Windows drivers on his gaming laptop and turn two findings into validated CVEs without dumping low‑quality reports on the vendor. He walks through CVE-2026-3508, an out-of-bounds read in AsusWmiAcpi.sys triggered by trusting a bogus internal size field in a buffered IOCTL, and CVE-2026-6737, where AsusPTPFilter.sys exposes IOCTLs to standard users because device objects are created without secure descriptors, leaving several named devices reachable. He stresses always proving bugs with working PoCs, understanding driver behavior instead of trusting model output, and heavily editing or rewriting AI-generated reports to avoid noisy, hype-driven writeups.
Read the full story