In 2021, a vulnerability was revealed in a system that lay at the foundation of modern computing. An attacker could force the system to execute arbitrary code. Shockingly, the vulnerable code was almost 54 years old — and there was no patch available, and no expectation that one would be forthcoming.

Fortunately, that’s because the system in question was Marvin Minsky’s 1967 implementation of a Universal Turing Machine, which, despite its momentous theoretical importance for the field of computer science, had never actually been built into a real-world computer. But in the decade or so after Minsky’s design, the earliest versions of Unix and DOS came into use, and their descendants are still with us today in the 21st century. Some of those systems have had bugs lurking beneath the surface for years or even decades.

Frontier AI tools such as Claude are making it much easier to uncover latent vulnerabilities at pace, since discovery is no longer limited by human attention span or manual triage speed. The resulting acceleration in flaw discovery is possible not because AI tools are uncovering new exploit classes, but because they are able to scan, chain reasoning, and test exploit paths at machine speed.

Here are 17 noteworthy bugs that, once long dormant, took over a decade to be discovered and fixed — in descending order of how long they went unaddressed.

Libpng Graphics Library Flaw

Age: 30 years Date introduced: 1995 Date fixed: February 2026

Researchers unearthed a legacy flaw in the widely used libpng open-source library that had existed since the technology was first released more than 30 years ago.

The heap buffer overflow vulnerability (CVE-2026-25646) meant that applications using the flawed software would crash when presented with a maliciously constructed PNG raster image file. Although difficult to exploit, the vulnerability potentially poses an information disclosure or remote code execution risk.

The vulnerable png_set_quantize function, previously called png_set_dither, is rarely used. This, in combination with the difficulty of exploitation, means the flaw earns a CVSS score of 8.3, rating it as “high” rather than “critical” risk.

Nonetheless, many Linux distributions (Debian, Red Hat, Ubuntu), desktop apps, and some Java runtimes rely on vulnerable versions of the library and need to be patched.

PrintDemon

Age: 24 years Date introduced: 1996 Date fixed: May 2020

Printers are a frequent pain point for IT because there are a lot of models, they aren’t made by the same vendors who make computers and operating systems, and users expect to plug them in and start printing. Microsoft in its early years battled to make installing a printer driver relatively easy and painless. But a bug found in 2020, dubbed PrintDemon, showed that maybe they took that a bit too far back in the ’90s — and paid for it for decades.

The core of the vulnerability lies in three facts: non-administrative users can add printers to a Windows machine; the underlying mechanics make it possible to print to a file rather than a physical printing device; and crucial printing services on Windows run with system privileges. That means that, if done correctly, an attacker can build a “printer” driver that creates a file (even an executable one) anywhere on the filesystem, including privileged directories. There are plenty of exploits that have been cooked up to take advantage of these design flaws — Stuxnet, it turns out, was one of them — but PrintDemon was a real doozy, made possible because Microsoft’s fixes over the years had been patches rather than a complete rebuild of the printing subsystem.

As Winsider described it, “With very subtle file system modifications, you can achieve file copy/write behavior that is not attributable to any process, especially after a reboot … with a carefully crafted port name, you can imagine simply having the Spooler drop a [portable executable] file anywhere on disk for you.”

win32k.sys Vulnerabilities

Age: 23 years Date introduced: 1996 Date fixed: 2019

Two significant vulnerabilities were detected in the Win32 API in Microsoft Windows in 2019. The first, found in April, was a Use-After-Free vulnerability, in which OS coding errors made it possible for programs to access system memory that should have been protected. This vulnerability was detected by security researchers when they discovered malicious hackers attempting to use it in the wild to gain control of computers. The other, discovered in December, was an elevation-of-privilege vulnerability lurking in the OS’s window switching functionality; this vulnerability was similarly discovered during active attacks, which simulated keystrokes to create memory leaks.

Both vulnerabilities have their origins in the early days of Windows. “The problem originates from the time when WIN32K made its debut with Windows NT 4.0, when much of Win32’s graphics engine was moved from user level to kernel to boost performance,” explained Boris Larin, senior security researcher at Kaspersky, in 2019. And while these two vulnerabilities have been patched, that long-ago decision on the part of Microsoft has had much broader effects — and probably will continue to do so, Larin noted. “Throughout the years, the WIN32K component has been responsible for more than a half of all kernel security vulnerabilities discovered in Windows.”

PuTTY Heap Overflow

Age: 20 years, 9 months Date introduced: January 1999 Date fixed: October 2019

PuTTY is a free and open-source suite of tools that includes a serial console, a terminal emulator, and various network file transfer applications, with SSH and other encryption schemes built in. It was originally released to bring tools Unix admins took for granted to Windows and Mac OS, but has expanded its scope and is now in wide use on Unix systems as well. While PuTTY was designed to secure network connections, it turns out there was a vulnerability lurking at its heart. This was a heap overflow that could be triggered by an insufficiently long SSH key, which could result in crashing PuTTY or even remote code execution.

The vulnerability was submitted to HackerOne as part of a bug bounty program, netting the submitter a $3,645 reward and a thank you from the PuTTY team, which noted that the bug had been present in the very earliest versions of the source code, dating back to 1999.

PostgreSQL Database Vulnerabilities

Age: 20+ years Date introduced: 2005 Date fixed: February 2026

An AI-powered security analysis tool was able to uncover a high-severity vulnerability in PostgreSQL, stemming from a flaw that dated back more than 20 years to early versions of the open-source relational database technology.

Developers at F5 warn that exploitation can cause a crash, and in some conditions could enable arbitrary code execution, especially if Address Space Layout Randomization (ASLR) is disabled. System administrators are urged to update to patched versions of the software. The commercial product Nginx Plus was also patched against related vulnerabilities discovered during the same research effort, as detailed in a DepthFirst blog post.

SIGRed DNS Vulnerability

Age: 17 years Date introduced: 2003 Date fixed: 2020

DNS is one of the underrated backbones of the internet — the system by which your computer knows what IP address correlates to any given URL. The system is hierarchical, with requests sent up and down the pyramid looking for DNS servers that know the answer to the question “Where is this computer?” As a result, DNS has been built into all major operating systems.

In 2020, Microsoft disclosed a critical vulnerability in its own version of DNS that had been lurking in the code for 17 years. The vulnerability, dubbed SIGRed by its discoverers at Check Point, was a buffer overflow flaw in Windows DNS servers that could be triggered by exploit code tucked into a DNS packet’s signature. A malicious nameserver could send such packets in response to requests, bypassing most security protections and potentially gaining remote access to the Microsoft DNS server. The attack was potentially wormable, meaning it could be automated and spread without user intervention — underscoring just how serious a long-dormant flaw can become once it is finally discovered and exploited in the wild.