Mehtab Zafar

I am currently pursuing my PhD at the National University of Singapore, advised by Abhik Roychoudhury. For my research, I am exploring automated testing, program analysis, and agentic approaches to finding and fixing software bugs at scale.

Before starting my PhD, I completed my master’s at NUS under Manuel Rigger. Prior to that, I worked as a Product Security Engineer at Red Queen Dynamics, following several years of developing Python software and contributing to open source through Google Summer of Code as both a student and mentor.

Outside of research, I occasionally do bug bounty hunting and have recently gotten into photography.

CVEs from poking at open source software

Project	CVEs
GIMP	CVE-2026-40915, CVE-2026-40916, CVE-2026-40917, CVE-2026-40918
PowerDNS	CVE-2026-33597, CVE-2026-33595, CVE-2026-33594, CVE-2026-40211
Rack	CVE-2026-34830

Publications

Agentic Verification of Software Systems

Haoxin Tu, Huan Zhao, Yahui Song, Mehtab Zafar, Ruijie Meng, Abhik Roychoudhury

The ACM International Conference on the Foundations of Software Engineering (FSE 2026) 2026

PDF Code

Posts

All posts →