Umar Pathan
Security researcher & reverse engineer
Hey, I'm Umar
umar0x in terminals and commit logs. I break things for a living: parsers, daemons, and decoders that forgot the internet is hostile. Vulnerability research, CVEs, and in-depth writeups about every bug I find.
You can find me on GitHub, X, Bluesky, or write to Click to copy.
What I do
Vulnerability research, parser differentials, and memory-safety archaeology in the software everyone runs and nobody audits. FFmpeg, media stacks, legacy decoders: code that has been quietly parsing untrusted input for decades.
How I work
Most of what I research starts small: a weird crash, an impossible state, a line of code nobody has touched in years. The interesting part is proving why it was exploitable at all.
Contact
Cold emails welcome, especially the ones with a stack trace attached. The reliable channels: mail to Click to copy, PGP for anything sensitive, Signal on request.
