● Trento, IT → Saarbrücken, DE

Matteo Leonelli

PhD Candidate/CISPA Helmholtz Center for Information Security /advisor: Prof. Dr. Thorsten Holz

Security researcher working on fuzzing, automated testing, and vulnerability discovery — building tools that find the inputs a program's authors never imagined, and the bugs that follow.

Biography

Matteo Leonelli is a Ph.D. fellow at the CISPA Helmholtz Center for Information Security, supervised by Prof. Dr. Thorsten Holz. Prior to this, he earned an M.Eng. in Security from Saarland University (2024) and a B.Sc. in Computer Science from the University of Trento (2021). His research focuses on fuzzing, automated testing, and vulnerability discovery, with a particular emphasis on novel approaches for detecting unusual behaviors and bug classes.

Publications

2026

THEMIS: Context-Aware Grey-box Fuzzing for WordPress Plugins

Matteo Leonelli, David Jannis Dewes, Thorsten Holz

IEEE European Symposium on Security and Privacy (EuroS&P)

[pdf] [code]

2025

SBFT Tool Competition 2025 – Fuzzing Track

Addison Crump, Sahil Sihag, Matteo Leonelli

Workshop on Search-Based and Fuzz Testing (SBFT)

[pdf]

TwinFuzz: Differential Testing of Video Hardware Acceleration Stacks

Matteo Leonelli, Addison Crump, Meng Wang, Florian Bauckholt, Keno Hassler, Ali Abbasi, Thorsten Holz

Network and Distributed System Security Symposium (NDSS)

[pdf] [code]

2021

Secure Pull Printing with QR Codes and National eID Cards: A Software-oriented Design and an Open-source Implementation

Matteo Leonelli, Umberto Morelli, Giada Sciarretta, Silvio Ranise

ACM Conference on Data and Application Security and Privacy (CODASPY)

[pdf] [code]

2020

Pull Printing with National eID Cards: An Open-source and Software-oriented Implementation

Matteo Leonelli, Umberto Morelli, Silvio Ranise, Giada Sciarretta

Italian Conference on Cybersecurity (ITASEC)

Experience

  1. 2024 — present

    Ph.D. Candidate

    CISPA Helmholtz Center for Information Security

    Research on functional and security-focused automated fuzz testing for complex system security.

  2. 2025

    Applied Scientist Intern

    Amazon Web Services (AWS)

    Researched and developed automated fuzz testing methods to evaluate and ensure data integrity in Amazon S3.

  3. 2021 — 2024

    Researcher

    Fondazione Bruno Kessler

    Research on secure protocol communication and contributions to application development.

  4. 2019 — 2021

    Developer

    Matrix Tech

    Built a web service to manage gate access and presence tracking on embedded system devices.

  5. 2018 — 2019

    Developer

    OGP

    Developed customer-facing websites and integrated new features.

Education

  1. 2024 — present

    Ph.D. in Cybersecurity

    CISPA Helmholtz Center for Information Security, Germany

  2. 2021 — 2024

    M.Eng. in Cybersecurity

    Saarland University, Germany

  3. 2018 — 2021

    B.Sc. in Computer Science

    University of Trento, Italy

  4. 2014 — 2018

    High School Diploma in Computer Science

    Marconi Rovereto, Italy

Achievements & CVEs

CVE-2024-23919
Improper buffer restrictions in Intel® Graphics software Intel Acknowledgements →
Reported
FFmpeg: global buffer overflow
Reported
FFmpeg: free attempted on address that was never malloc'ed
CVE-2025-9219
Post SMTP — missing authorization to authenticated subscriber
CVE-2025-5701
HyperComments — unauthenticated arbitrary options update
CVE-2023-7306
Frontend File Manager — unauthenticated arbitrary post deletion

Talks & Summer Schools