Code Intelligence Blog

AI-automated Fuzzing Uncovers Two More Vulnerabilities in wolfSSL

Peter Samarin — Wed, 11 Jun 2025 08:44:46 GMT

Daniel Pouzzner from wolfSSL has challenged us to find 3 more vulnerabilities in the wolfSSL library, after we found the first one in October 2024. We weren't quite able to find three, but here are the additional two that we found:

Heap buffer overflow WRITE in wolfSSL_d2i_RSAPrivateKey_bio. Fixed in PR 8426.
Stack buffer overflow READ into heap buffer overflow WRITE in wolfSSL_SMIME_write_PKCS7. Fixed in PR 8466.

Both vulnerabilities were fixed in wolfSSL version 5.8.0, released on 24 April 2025. The fuzz tests that found these vulnerabilities were generated by our AI Test Agent.

How to Get Started With Fuzz Testing

Natalia Kazankova — Wed, 28 May 2025 12:35:14 GMT

Scope of the project

If you recognize the benefits that fuzz testing can bring to your software security but are new to it, read on. In this blog post, you’ll learn what you need to consider before implementing fuzz testing in your company to ensure a smooth and successful adoption.

Automotive Supplier Finds 32% of Bugs Through Fuzz Testing

Natalia Kazankova — Wed, 23 Apr 2025 08:43:27 GMT

Scope of the project

An automotive supplier employs static analysis and Code Intelligence's Fuzz Testing to assess software within a separate business unit. The project comprises 10 million lines of C code, adhering to Classic AUTOSAR standards.

Memory Safety Bugs: An In-Depth Look At Critical Issues | Blog

Natalia Kazankova — Wed, 16 Apr 2025 14:13:48 GMT

Memory safety vulnerabilities remain among the most widespread and exploited security issues. They occur in C and C++ projects, which are widely used across embedded systems, including automotive, medical devices, and avionics. Read on to learn why they can happen and how to prevent them.

Content

What Are Memory Safety Issues
Why Memory Safety Matters
Real-World Examples of Memory Corruption
Example of a Memory Safety Bug
How to Detect Memory Corruption

Medical Device Regulation (MDR): Why Cybersecurity And Fuzz Testing Are No Longer Optional

Natalia Kazankova — Tue, 08 Apr 2025 14:29:19 GMT

Europe has shifted from the old MDD (Medical Device Directive) to the newer MDR (Medical Device Regulation).

The transition has caused confusion and inconsistency, as some devices are still MDD-certified and need to transition, while others are already under MDR.
MDR specifies “what” needs to be done, but not “how” to do it — leaving gaps in implementation details.
Fuzz testing is explicitly mentioned in the MDCG guidance documents (MDCG 2019-16) and IEC 81001-5-1. Both documents are considered state of the art. They are not legally binding but auditors may treat them mandatory.

AI-automated Fuzzing Found a Dynamic Stack Buffer Overflow in abseil-cpp

info@code-intelligence.com (Markus Zoppelt) — Fri, 07 Mar 2025 10:13:05 GMT

A dynamic stack buffer overflow vulnerability in the Abseil C++ library (abseil-cpp) was autonomously identified through AI-enhanced fuzz testing using CI Fuzz’s AI Test Agent and has been fully addressed with a patch. This post dives into the vulnerability, its discovery, and its implications for systems relying on this widely-used library.

AI-Automated Fuzzing Found a Heap Buffer Overflow in AWS C Common Library

info@code-intelligence.com (Markus Zoppelt) — Wed, 26 Feb 2025 12:57:48 GMT

A critical heap buffer overflow vulnerability in the AWS C Common library was discovered autonomously through an AI-automated fuzz testing solution, CI Fuzz, and has been fully addressed with a patch. In this post, we explore the vulnerability and its potential impact on embedded systems.

Top Six Most Dangerous Vulnerabilities in C and C++

Natalia Kazankova — Fri, 14 Feb 2025 14:05:00 GMT

C and C++ programming are notorious for being bug-prone. Let’s look at the most dangerous software weaknesses in 2024 that are relevant for C and C++, so that you know what type of issues to test your code against in 2025.

Meet Spark, an AI Test Agent That Autonomously Uncovers Vulnerabilities

Natalia Kazankova — Wed, 29 Jan 2025 18:51:58 GMT

We’re thrilled to announce the general availability of Spark, an AI Test Agent that lowers the entry barrier to white-box fuzz testing. In this blog, we explain how Spark works and share the main results from its beta testing that prove its effectiveness.

Top Fuzz Testing Tools of 2025: Feature Comparison

Natalia Kazankova — Wed, 29 Jan 2025 18:30:32 GMT

In 2025, fuzz testing has become an essential practice for ensuring software security and reliability. By identifying vulnerabilities through randomized input testing, fuzzing helps development teams uncover bugs that traditional testing methods—such as static analysis and penetration testing—often miss. With rapid advancements in security tools, let’s explore the top fuzz testing tools of 2025, their key features, benefits, and how they compare.