ANT-2026-QRHVDRQ1 · unicorn

heap-buffer-overflow medium

Severity Claude medium · Security research firm medium · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-QRHVDRQ1: Heap buffer overflow via MIPS CP0 SRSCtl shadow register set OOB write due to invalid PSS/ESS values

Invalid PSS/ESS values in the MIPS CP0 SRSCtl register cause an out-of-bounds write into the shadow register set array on the heap.

Target

Project: unicorn
Discovery: static analysis — not yet dynamically reproduced

Technical Details

The PSS/ESS fields of the CP0 SRSCtl register are used to index the shadow register set without proper bounds validation; an invalid value leads to a heap OOB write when the selected shadow register set is accessed.

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-QRHVDRQ1.

Reference: ANT-2026-QRHVDRQ1
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits.

Verdict: true positive
Severity: medium

TIMELINE

Dates from discovery through public reveal.

2026-03-29 Reported to tracker
2026-04-09 Sent to maintainer
2026-05-09 Maintainer acknowledged
2026-08-04 Patch released
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

ab25ae3cdb064e2c16ac9958c21cc3a81fb8bc7b2a53eebbe7150cdad3f753702e34a46e8d56fd5b54bd78c6f8ddff8c2c7475e0566fa9257dd93664779b31c5

Committed 2026-04-09 11:50 PT

Revealed 2026-08-17 10:47 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-QRHVDRQ1",
  "bug_class": "Heap Buffer Overflow",
  "claude_severity": "medium",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:28+00:00",
  "description": "Invalid PSS/ESS values in the MIPS CP0 SRSCtl register cause an out-of-bounds write into the shadow register set array on the heap.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "Unicorn",
  "reproduction": null,
  "technical_details": "The PSS/ESS fields of the CP0 SRSCtl register are used to index the shadow register set without proper bounds validation; an invalid value leads to a heap OOB write when the selected shadow register set is accessed.",
  "title": "Heap buffer overflow via MIPS CP0 SRSCtl shadow register set OOB write due to invalid PSS/ESS values",
  "vendor_severity": "medium"
}