Malcolm Stagg, Author at Synack

Malcolm Stagg

Malcolm Stagg is a security researcher on the Synack Red Team who joined after completing Synack's capture-the-flag qualifier for DARPA's FETT bug bounty program, which gave him rare access to DARPA's SSITH secure hardware. A former Microsoft software engineer who worked on Remote Desktop network transport, he discovered CVE-2021-34535, an RCE vulnerability in Remote Desktop Client, and CVE-2024-0333, a Google Chrome flaw that could enable installation of malicious extensions. He was nominated for the 2022 CyberScoop 50 Awards.

This Microsoft Windows RCE Vulnerability Gives an Attacker Complete Control

Network & Host

Nov 24, 2021

This Microsoft Windows RCE Vulnerability Gives an Attacker Complete Control

By Malcolm Stagg The Microsoft Windows RCE Vulnerability, or CVE-2021-34535, is a Remote Code Execution (RCE) vulnerability in Remote Desktop Client, found by SRT member Malcolm Stagg earlier this year, and patched by Microsoft in August 2021. Finding the Vulnerability I found this vulnerability by looking at the disassembly of several Windows dll’s in IDA […]

Malcolm Stagg

5 min read

Malcolm Stagg

Research by Malcolm Stagg

ZIP embedding attack on Google Chrome extensions

This Microsoft Windows RCE Vulnerability Gives an Attacker Complete Control