About Me

• Ph.D. student in KAIST Hacking Lab (Advisor: Insu Yun)
• Main research interest in automated compiler testing
• Also interested in automated software testing and binary analysis

Education

• Pohang University of Science and Technology (POSTECH) — 2017/02–2022/02
  B.S. in Computer Science and Engineering
• Korea Advanced Institute of Science and Technology (KAIST) — 2022/03–2024/02
  M.S. in Graduate School of Information Security (GSIS)
  KAIST Hacking Lab (Advisor: Insu Yun)
• Korea Advanced Institute of Science and Technology (KAIST) — 2024/03–present (expected 2028/02)
  Ph.D. in School of Electrical Engineering
  KAIST Hacking Lab (Advisor: Insu Yun)

Publications & Projects

International Conferences

1. RTCon: Context-Adaptive Function-Level Fuzzing for RTOS Kernels Paper Code
   Eunkyu Lee, Junyoung Park, and Insu Yun
   Proceedings of the 2026 Network and Distributed System Security Symposium (NDSS 2026)
   San Diego, CA, 2026/02
2. Windows plays Jenga: Uncovering Design Weaknesses in Windows File System Security Paper
   Dong-uk Kim*, Junyoung Park*, Sanghak Oh, Hyoungshick Kim, and Insu Yun
   Proceedings of the 32nd ACM Conference on Computer and Communications Security (CCS)
   Taipei, Taiwan, 2025/10
   * Equal Contribution
3. RGFuzz: Rule-Guided Fuzzer for WebAssembly Runtimes Paper Code
   Junyoung Park, Yunho Kim, and Insu Yun
   Proceedings of the 46th IEEE Symposium on Security and Privacy (Oakland)
   San Francisco, CA, 2025/05

Thesis

• Fuzzing WebAssembly compilers using optimization rules
  Junyoung Park
  M.S. thesis, KAIST
  Daejeon, Korea, 2024/12

Other Projects

• Agentic Fuzzing: Opportunities and Challenges Paper
  Junyoung Park and Insu Yun
  arXiv, 2026/05

CVEs

• VirtualBox: CVE-2021-2127 and CVE-2021-2266
• Firefox: CVE-2023-29548
• Golang: CVE-2025-0913 (GHSA-jw54-c8rr-pjpq)
• Chrome: CVE-2026-2649, CVE-2026-11075, and CVE-2026-7902

Activities

• .HACK Conference 2025 Speaker — 2025
  Title: Compiler Rule-based WebAssembly Runtime Fuzzing
  Place: COEX, Seoul, Republic of Korea
• KITRI BoB 9th Vulnerability Analysis — 2020
  Project: Virtualization Software Bug Hunting — team VirtualBoBs
  Result: 3 CVEs (CVE-2021-2086, CVE-2021-2124, CVE-2021-2127), 3 ZDI-CAN findings (ZDI-CAN-12407, ZDI-CAN-12621, ZDI-CAN-12761 — total $6,500)

• CTF Participation — 2017–present
  Team: Previously PLUS (2017–2021), currently an individual player
  Major participations:

  • DEFCON 26, 27, and 28 finalist (respectively with KaisHack+PLUS+GoN, seoulplusbadass, and koreanbadass); partially and remotely participated in DEFCON 32 (with Cold Fusion)
  • DEFCON 34 finalist (0x4b52) — 2nd place
  • Codegate CTF Finals (University) 2018, 2019, and 2020 (PLUS — respectively 4th, 1st, and 2nd)

Patents

• Fuzzing-Based Vulnerability Detection Method
  Insu Yun, Eunkyu Lee, Junyoung Park
  KR 10-2025-016972

Download CV (PDF)