Mehtab Zafar

I am currently pursuing my PhD at the National University of Singapore, advised by Abhik Roychoudhury. For my research, I am exploring automated testing, program analysis, and agentic approaches to uncover security vulnerabilities in software at scale.

Before starting my PhD, I completed my master’s at NUS under Manuel Rigger. Prior to that, I worked as a Product Security Engineer with Tarah Wheeler at Red Queen Dynamics, following several years of developing Python software and contributing to open source through Google Summer of Code as both a student and mentor.

Outside of research, I occasionally do bug bounty hunting and have recently gotten into photography.

CVEs from poking at open source software

GIMP

  • CVE-2026-40915
  • CVE-2026-40916
  • CVE-2026-40917
  • CVE-2026-40918

PowerDNS

  • CVE-2026-33597
  • CVE-2026-33595
  • CVE-2026-33594
  • CVE-2026-40211

Rack

  • CVE-2026-34830

Publications

Agentic Orchestration for Hybrid Fuzzing

Zhengxiong Luo, Huan Zhao, Mehtab Zafar, Cristian Cadar, Abhik Roychoudhury

Network and Distributed System Security (NDSS) 2027

PDF

Agentic Verification of Software Systems

Haoxin Tu, Huan Zhao, Yahui Song, Mehtab Zafar, Ruijie Meng, Abhik Roychoudhury

The ACM International Conference on the Foundations of Software Engineering (FSE) 2026

PDF Code

Posts

All posts →