David Strnadel

Independent researcher

David
Strnadel.

Security & AI Research

I investigate iOS and macOS vulnerabilities through binary diffing, reverse engineering and AI-assisted research. Based in Czechia, working internationally.

Explore my research
Three separated software layers, with a highlighted path crossing the interface into the kernel.
01 — A study in boundaries
Based in Czechia Working internationally 03Public Apple CVE credits 01AI research preprint

01 / Selected investigations

Small details.
Real consequences.

Two investigations into the boundaries
software is supposed to enforce.

iOS kernel · Binary diffingCVE-2026-65398

IOMobileFrameBuffer

A missing check.
A question about kernel memory.

While comparing iOS builds, I noticed that a new operation lacked a condition present in a related one. That difference became an out-of-bounds hypothesis, a proof of concept, and a report to Apple.

Read the research summary

From difference to hypothesis

I used binary diffing to narrow down security-relevant changes during the iOS beta cycle. Comparing related operations helped isolate a missing condition and formulate a testable out-of-bounds hypothesis.

Test, then report

I developed an on-device proof of concept and documented the result for Apple. I directed the investigation and used AI to accelerate reverse analysis, PoC development, and the technical report.

Public outcome

Apple credited the issue as CVE-2026-65398, with shared attribution. Its advisory describes an out-of-bounds access issue that could allow an app to cause a system crash or corrupt kernel memory.

Apple acknowledgement · Shared creditRead the technical writeup
Sandbox boundaries · PrivacyONE REPORT / TWO CVEs

AuthKit & Accessibility

The file said no.
The service returned data.

I investigated a mismatch between direct file access and access through system services. The sandbox denied file reads, while public preference APIs returned data from other domains.

Read the research summary

Compare the access paths

I built an on-device proof of concept to compare denied direct file reads with service-mediated preference access. A separate WidgetKit extension provided an independent process for checking the behaviour.

Rule out the wrong conclusion

Cross-process controls helped distinguish data exposure from writes that remained in a process-local cache. Those writes did not establish a cross-process write capability.

One investigation, two issues

Apple split the original report and tracked the resulting issues under AuthKit (CVE-2026-43730) and Accessibility (CVE-2026-43664). The Accessibility credit is shared with other researchers.

Two publicly credited CVEsExplore both technical notes

02 / Experimental AI

Ideas are a start.
Experiments decide.

Alongside security research, I test ideas
about how models learn.

Preprint · 2025

VQE-in-GAN

Energy-based regularization
in generative models.

I explored VQE-inspired auxiliary losses in GAN training using PyTorch and Qiskit simulation. Controlled comparisons found no measurable benefit over simpler classical alternatives in the studied setting.

Simulator-based study. Published methods, ablations, and a negative result.

Read the preprint Code
Ongoing · Master’s research

JEPA × spiking networks

Latent prediction across
neural substrates.

I investigate whether JEPA-style learning could benefit neuromorphic computation, comparing conventional and spiking neural networks through software experiments.

PyTorch experiments and Lava simulation. No experiments on physical Intel Loihi hardware.

Explore the research

03 / A little background

Curiosity.
With controls.

I came to vulnerability research through software testing and applied AI. I like taking a system apart, finding the assumption that matters, and building an experiment around it.

AI helps me move faster. Reproducible evidence is how I decide whether an idea holds up.

2026 — PRESENTIndependent security research
Apple platforms, reverse engineering, and AI-assisted vulnerability discovery.
2026Revelia
AI Analyst / Data Scientist / Project Manager.
2021 — 2026ZF Group
Software testing in embedded and AUTOSAR environments.
EDUCATIONTomas Bata University in Zlín
BSc in Software Engineering, 2025.
MSc in Cybersecurity in progress.

Have something worth investigating?

Czechia / Remote

Let’s look closer.

Available for security research roles and focused vulnerability research collaborations, remotely from Czechia.

Get in touch