PoC Archive PoC Archive

tag

IOS

  • CVE-2025-54957 binary CRITICAL 9.8

    Dolby Unified (DDPlus) Decoder Out-of-Bounds Write via Evolution Data (CVE-2025-54957)

    CVE-2025-54957 is a critical out-of-bounds write vulnerability in Dolby's DDPlus Unified Decoder, triggered while processing "evolution" data in an AC-3/EC-3 (Dolby Digital Plus) bitstream. An integer overflow in the length calculation for evolution-data…

    Unverified 2026-07-06
  • CVE-2026-20698 binary HIGH

    XNU PF_ROUTE RTA_GENMASK Heap Buffer Overflow (CVE-2026-20698)

    XNU's routing socket implementation processes RTMGET messages carrying an RTAGENMASK sockaddr through rnaddmask(), which copies the supplied genmask into a fixed, address-family-dependent radix-tree node buffer without validating that the attacker-controlled…

    Patched 2026-07-05
  • CVE-2026-28995 misc HIGH

    iOS App Intents Path Traversal — CVE-2026-28995

    Apple's App Intents framework insufficiently validates file paths supplied to an intent's handler, allowing a malicious app to read arbitrary files outside its normal app sandbox. The PoC defines an AppIntent whose readCve(path:) function prepends a long…

    Patched 2026-07-05
  • CVE-2026-20637 binary HIGH

    AppleSEPKeyStore IOKit Use-After-Free (CVE-2026-20637)

    The AppleSEPKeyStore kernel driver exposes an IOKit user client (AppleKeyStore) whose command gate can be freed while still being accessed, producing a use-after-free. The PoC opens repeated IOServiceOpen connections while separate threads race…

    Patched 2026-07-05
  • CVE-2026-43655 binary HIGH

    AppleM2ScalerCSCDriver Shared Scheduler Use-After-Free (CVE-2026-43655)

    CVE-2026-43655 is a use-after-free in the AppleM2ScalerCSCDriver kernel driver's shared scaler-operation scheduler, reachable from a default-sandboxed iOS/iPadOS/macOS app with no special entitlements (only get-task-allow, no jailbreak or private…

    Unverified 2026-07-05
  • CVE-2026-20687 binary HIGH

    AppleJPEGDriver startDecoder Timeout Use-After-Free (CVE-2026-20687)

    AppleJPEGDriver's synchronous decode path (startDecodersync) can time out while a decode request is still referenced by a per-codec queue-node vector; on timeout the driver frees the request object but fails to remove its embedded queue-node pointer from that…

    Patched 2026-07-05
  • web CRITICAL 9.3

    FirefUXSS: Universal XSS in Firefox Focus for iOS via Redirect-Scheme Validation Race Condition

    FirefUXSS is a universal XSS issue in Firefox Focus for iOS where redirect-scheme validation can be bypassed via a race condition. A burst of benign redirects can desynchronize validation from navigation commit, allowing a final javascript: redirect to…

    Unpatched 2026-06-08