LARP is a team of vulnerability researchers and bug hunters. We find security bugs in software people rely on, report them to the vendor, and publish the details once they are fixed.https://larp-security.com/enhttps://larp-security.com/research/LARP-2026-014/https://larp-security.com/research/LARP-2026-014/The engine sizes a buffer from one field in the font and copies data based on another. A crafted font makes them disagree, which gives a two-byte heap overflow. We used it to corrupt a function pointer.Wed, 21 Oct 2026 00:00:00 GMTmemoryhello@larp.example (kaze & m0th)https://larp-security.com/research/LARP-2026-012/https://larp-security.com/research/LARP-2026-012/The service rendered uploaded PDFs on the server, and PDFs can load remote resources. That was enough to reach internal endpoints, including the cloud metadata service.Wed, 02 Sep 2026 00:00:00 GMTwebhello@larp.example (yuzu)https://larp-security.com/research/LARP-2026-011/https://larp-security.com/research/LARP-2026-011/An exported activity forwarded any intent it received, which gave other apps access to components that were supposed to be private. We cover the bug, the fix, and a lint rule that catches it.Sat, 18 Jul 2026 00:00:00 GMTmobilehello@larp.example (sable)https://larp-security.com/research/LARP-2026-010/https://larp-security.com/research/LARP-2026-010/The pairing counter resets on every reboot, so the same nonce gets used twice. With two captured handshakes, the session key can be recovered.Fri, 05 Jun 2026 00:00:00 GMTcryptohello@larp.example (m0th & ampere)https://larp-security.com/research/LARP-2025-031/https://larp-security.com/research/LARP-2025-031/A race between two rename calls drops a reference one time too many. We explain the race and how we made the exploit reliable on stock hardware.Thu, 11 Dec 2025 00:00:00 GMTkernelhello@larp.example (kaze)https://larp-security.com/research/LARP-2025-027/https://larp-security.com/research/LARP-2025-027/A glitch at the right moment skips the signature check in the boot ROM. Most of the work was finding the timing. The bug is in ROM, so it cannot be patched.Thu, 09 Oct 2025 00:00:00 GMThardwarehello@larp.example (ampere)https://larp-security.com/research/LARP-2025-019/https://larp-security.com/research/LARP-2025-019/Getting to code execution took eleven attempts. We wrote up the failed ones as well, since they show where the engine is actually hardened.Sun, 22 Jun 2025 00:00:00 GMTwebhello@larp.example (yuzu & sable)https://larp-security.com/research/LARP-2025-008/https://larp-security.com/research/LARP-2025-008/A step by step walkthrough, from how the JIT works to a working read/write primitive. Everything in it can be reproduced on a laptop.Fri, 14 Mar 2025 00:00:00 GMTmemoryhello@larp.example (m0th)https://larp-security.com/research/LARP-2024-022/https://larp-security.com/research/LARP-2024-022/The harness generator we use internally, cleaned up and released under the MIT license.Sat, 30 Nov 2024 00:00:00 GMTtoolinghello@larp.example (the whole team)https://larp-security.com/research/LARP-2024-007/https://larp-security.com/research/LARP-2024-007/What went well, what didn't, and a disclosure we handled badly.Tue, 02 Apr 2024 00:00:00 GMTnoteshello@larp.example (the whole team)