tag
IOS
Dolby Unified (DDPlus) Decoder Out-of-Bounds Write via Evolution Data (CVE-2025-54957)
CVE-2025-54957 is a critical out-of-bounds write vulnerability in Dolby's DDPlus Unified Decoder, triggered while processing "evolution" data in an AC-3/EC-3 (Dolby Digital Plus) bitstream. An integer overflow in the length calculation for evolution-data…
XNU PF_ROUTE RTA_GENMASK Heap Buffer Overflow (CVE-2026-20698)
XNU's routing socket implementation processes RTMGET messages carrying an RTAGENMASK sockaddr through rnaddmask(), which copies the supplied genmask into a fixed, address-family-dependent radix-tree node buffer without validating that the attacker-controlled…
iOS App Intents Path Traversal — CVE-2026-28995
Apple's App Intents framework insufficiently validates file paths supplied to an intent's handler, allowing a malicious app to read arbitrary files outside its normal app sandbox. The PoC defines an AppIntent whose readCve(path:) function prepends a long…
AppleSEPKeyStore IOKit Use-After-Free (CVE-2026-20637)
The AppleSEPKeyStore kernel driver exposes an IOKit user client (AppleKeyStore) whose command gate can be freed while still being accessed, producing a use-after-free. The PoC opens repeated IOServiceOpen connections while separate threads race…
AppleM2ScalerCSCDriver Shared Scheduler Use-After-Free (CVE-2026-43655)
CVE-2026-43655 is a use-after-free in the AppleM2ScalerCSCDriver kernel driver's shared scaler-operation scheduler, reachable from a default-sandboxed iOS/iPadOS/macOS app with no special entitlements (only get-task-allow, no jailbreak or private…
AppleJPEGDriver startDecoder Timeout Use-After-Free (CVE-2026-20687)
AppleJPEGDriver's synchronous decode path (startDecodersync) can time out while a decode request is still referenced by a per-codec queue-node vector; on timeout the driver frees the request object but fails to remove its embedded queue-node pointer from that…
FirefUXSS: Universal XSS in Firefox Focus for iOS via Redirect-Scheme Validation Race Condition
FirefUXSS is a universal XSS issue in Firefox Focus for iOS where redirect-scheme validation can be bypassed via a race condition. A burst of benign redirects can desynchronize validation from navigation commit, allowing a final javascript: redirect to…