<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Iokit — PoC Archive</title><link>https://poc.intelseclab.com/tags/iokit/</link><description>Latest proof-of-concept entries.</description><generator>Hugo</generator><language>en-us</language><lastBuildDate>Sun, 05 Jul 2026 00:00:00 +0000</lastBuildDate><atom:link href="https://poc.intelseclab.com/tags/iokit/index.xml" rel="self" type="application/rss+xml"/><item><title>AppleSEPKeyStore IOKit Use-After-Free (CVE-2026-20637)</title><link>https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20637-applesepkeystore-uaf/</link><pubDate>Sun, 05 Jul 2026 00:00:00 +0000</pubDate><guid>https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20637-applesepkeystore-uaf/</guid><description>High severity — binary · CVE-2026-20637. Status: PoC. Affects: AppleSEPKeyStore driver (com.apple.driver.AppleSEPKeyStore, exposed as IOKit service AppleKeyStore). Tags: ios, macos, kernel, iokit, use-after-free, race-condition, aksepkeystore, xnu, kernel-panic.</description><category>binary</category><category>High</category><category>ios</category><category>macos</category><category>kernel</category><category>iokit</category><category>use-after-free</category><category>race-condition</category><category>aksepkeystore</category><category>xnu</category><category>kernel-panic</category></item><item><title>AppleM2ScalerCSCDriver Shared Scheduler Use-After-Free (CVE-2026-43655)</title><link>https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43655-apple-m2-scalercscdriver-uaf/</link><pubDate>Sun, 05 Jul 2026 00:00:00 +0000</pubDate><guid>https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43655-apple-m2-scalercscdriver-uaf/</guid><description>High severity — binary · CVE-2026-43655. Status: PoC. Affects: Apple AppleM2ScalerCSCDriver kext / IOSurfaceAcceleratorClient user-client (iOS, iPadOS, macOS on Apple M2-family scaler hardware). Tags: use-after-free, ios, ipados, macos, kernel, iokit, iosurface, kext, sandbox-escape-adjacent, memory-corruption.</description><category>binary</category><category>High</category><category>use-after-free</category><category>ios</category><category>ipados</category><category>macos</category><category>kernel</category><category>iokit</category><category>iosurface</category><category>kext</category><category>sandbox-escape-adjacent</category><category>memory-corruption</category></item><item><title>AppleJPEGDriver startDecoder Timeout Use-After-Free (CVE-2026-20687)</title><link>https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20687-applejpegdriver-uaf/</link><pubDate>Sun, 05 Jul 2026 00:00:00 +0000</pubDate><guid>https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20687-applejpegdriver-uaf/</guid><description>High severity — binary · CVE-2026-20687. Status: PoC. Affects: AppleJPEGDriver kernel extension. Tags: ios, kernel, applejpegdriver, use-after-free, mte, iokit, kernel-panic, camera.</description><category>binary</category><category>High</category><category>ios</category><category>kernel</category><category>applejpegdriver</category><category>use-after-free</category><category>mte</category><category>iokit</category><category>kernel-panic</category><category>camera</category></item></channel></rss>