~$ whoami

Diego Palacios // DiegoAltF4

The adventures of a 23-year-old security researcher. I like to escape virtual machines and blog about it, when I don't crash along the way ;)

Selected posts

Oct 17, 2024 CVE-2023-22098: Oracle VM VirtualBox 7.0.10 r158379 Escape Join me for an in-depth analysis of CVE-2023-22098.
Apr 14, 2024 Quememu Writeup HackOn 2024 CTF Writeup for the HackonCTF challenge "Quememu". The goal is to escape from Qemu by abusing a vulnerable PCI ...

Research highlights

CVE-2026-47047High0day VirtualBox malicious OVA → host file write → host code exec Oracle advisory → CVE-2026-35275High0day VirtualBox VM escape Oracle advisory → CVE-2026-35247Medium0day VirtualBox guest-to-host infoleak → ASLR bypass Oracle advisory → CVE-2023-22098HighN-day VirtualBox VM escape Read the write-up → CVE-2023-4911HighN-day Linux LPE (Looney Tunables) Read the exploit →