Zero-day CSS: CVE-2026-2441 exists in the wild

Re:Zero-day CSS: CVE-2026-2441 exists in the wild by UncleMeat on Thursday February 19, 2026 @09:40AM (#47074252)

They’ve gotten way better at this over the last decade with coverage guided execution.

[ Parent | on HN ]

Re:Zero-day CSS: CVE-2026-2441 exists in the wild by anematode on Thursday February 19, 2026 @10:43AM (#47075011)

Well, yes and no. For example, coverage-guided fuzzers won't reliably find the taken branch in

  if (hash(x) == 0x12345678) {

  }

Of course this is contrived, but you can imagine something similar where it requires a delicate setup for that branch to be taken at all, that a human (or these days, an LLM) can find straightforwardly.

[ Parent | on HN ]