Real-Life Examples
Each page uses hereticus on a published security fix, in the binaries
that the vendor shipped. It compares the binary before the fix with the
binary after the fix, and shows where the fixed function is in the report.
Each page gives the commands to get the binaries and to do it again.
The binaries are stripped, and each update holds more changes than the fix. Thus the report also lists functions that the fix did not touch. The row of the fix is the row that a reader gets to before the fix is found. Lower is better.
| Fix | Binary, release | Build | Row of the fix | Rows |
|---|---|---|---|---|
| CVE-2019-19945 | uhttpd, OpenWrt 18.06.5 to 18.06.6 | AArch64 | 3 | 5 |
| CVE-2020-7248 | libubox, OpenWrt 19.07.0 to 19.07.1 | AArch64 | 1 | 3 |
| CVE-2021-30883 | AppleCLCD, iOS 15.0.1 to 15.0.2 | kext | 1 | 333 |
| CVE-2024-23265 | AppleDiskImages2, iOS 17.3.1 to 17.4 | kext | 1 | 33 |
| CVE-2025-14282 | dropbear, OpenWrt 24.10.4 to 24.10.5 | AArch64 | 2 | 14 |
| CVE-2025-24257 | IOGPUFamily, iOS 18.3.2 to 18.4 | kext | 19 | 403 |
| CVE-2025-62525 | the ltq-ptm kernel module, OpenWrt 24.10.3 to 24.10.4 | MIPS32 BE | 1 | 2 |
| CVE-2025-62526 | ubusd, OpenWrt 24.10.3 to 24.10.4 | AArch64 | 5 | 8 |
| CVE-2026-28825 | smbfs, macOS 26.3.1 to 26.4 | kext | 9 | 462 |
| CVE-2026-30873 | jsonfilter, OpenWrt 24.10.5 to 24.10.6 | AArch64 | 1 | 1 |
| CVE-2026-30874 | procd, OpenWrt 24.10.5 to 24.10.6 | AArch64 | 1 | 24 |
| CVE-2026-35385 | dropbear scp, OpenWrt 24.10.7 to 24.10.8 | AArch64 | 1 | 19 |
| CVE-2026-53921 | odhcpd, OpenWrt 24.10.7 to 24.10.8 | AArch64 | 5 | 18 |
| CVE-2026-55614 | uhttpd, OpenWrt 24.10.7 to 24.10.8 | AArch64 | 5 | 13 |
Most pages also give the rows of other builds, as A32 and MIPS. The
OpenWrt binaries are all stripped with sstrip. The Apple binaries are
kernel extensions (kexts), taken out of the kernelcache with ipsw.
hereticus-cli/tests/truth_cves.rs locks each row, so a change that moves
a fix down fails the tests.