#security

a remote, largely zero-click denial of service in outlook and the windows search indexer: an opaque-signed pkcs#7 message nested a few thousand layers deep exhausts the thread stack because the shared mime decoder has no recursion depth limit. found statically with glaurung, declined by microsoft as low severity, disclosed here so mail scanners can detect it and vendors can add the one-line cap.

six months building glaurung, sixty distracted minutes using it: lift all of notepad.exe, rank candidates with an llm, confirm on ground-truth disassembly, reproduce a heap overflow live on a shipping binary — then honestly conclude microsoft should not fix it. a worked example of llm-assisted decompilation done without fooling yourself.