IOS — PoC Archivehttps://poc.intelseclab.com/tags/ios/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Dolby Unified (DDPlus) Decoder Out-of-Bounds Write via Evolution Data (CVE-2025-54957)https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-54957-dolby-decoder-oob-write/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-54957-dolby-decoder-oob-write/Critical severity (CVSS 9.8) — binary · CVE-2025-54957. Status: Weaponized. Affects: Dolby Digital Plus (DDPlus) Unified Decoder — bundled in Android media stack, iOS/macOS CoreAudio-adjacent decoders, and ChromeOS. Tags: dolby, ddplus, ac-3, ec-3, audio-codec, out-of-bounds-write, integer-overflow, zero-click, android, ios, macos, heap-corruption.binaryCriticaldolbyddplusac-3ec-3audio-codecout-of-bounds-writeinteger-overflowzero-clickandroidiosmacosheap-corruptionXNU PF_ROUTE RTA_GENMASK Heap Buffer Overflow (CVE-2026-20698)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20698-xnu-pf-route-heap-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20698-xnu-pf-route-heap-overflow/High severity — binary · CVE-2026-20698. Status: PoC. Affects: XNU kernel routing socket subsystem (PF_ROUTE, bsd/net/rtsock.c / bsd/net/radix.c). Tags: xnu, kernel, ios, macos, pf_route, routing-socket, heap-overflow, radix-tree, kernel-panic, bounds-safety.binaryHighxnukerneliosmacospf_routerouting-socketheap-overflowradix-treekernel-panicbounds-safetyiOS App Intents Path Traversal — CVE-2026-28995https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-28995-ios-appintents-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-28995-ios-appintents-path-traversal/High severity — misc · CVE-2026-28995. Status: PoC. Affects: Apple App Intents framework (iOS). Tags: ios, app-intents, path-traversal, sandbox-escape, swift, file-disclosure, mobile.miscHighiosapp-intentspath-traversalsandbox-escapeswiftfile-disclosuremobileAppleSEPKeyStore IOKit Use-After-Free (CVE-2026-20637)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20637-applesepkeystore-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20637-applesepkeystore-uaf/High severity — binary · CVE-2026-20637. Status: PoC. Affects: AppleSEPKeyStore driver (com.apple.driver.AppleSEPKeyStore, exposed as IOKit service AppleKeyStore). Tags: ios, macos, kernel, iokit, use-after-free, race-condition, aksepkeystore, xnu, kernel-panic.binaryHighiosmacoskerneliokituse-after-freerace-conditionaksepkeystorexnukernel-panicAppleM2ScalerCSCDriver Shared Scheduler Use-After-Free (CVE-2026-43655)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43655-apple-m2-scalercscdriver-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43655-apple-m2-scalercscdriver-uaf/High severity — binary · CVE-2026-43655. Status: PoC. Affects: Apple AppleM2ScalerCSCDriver kext / IOSurfaceAcceleratorClient user-client (iOS, iPadOS, macOS on Apple M2-family scaler hardware). Tags: use-after-free, ios, ipados, macos, kernel, iokit, iosurface, kext, sandbox-escape-adjacent, memory-corruption.binaryHighuse-after-freeiosipadosmacoskerneliokitiosurfacekextsandbox-escape-adjacentmemory-corruptionAppleJPEGDriver startDecoder Timeout Use-After-Free (CVE-2026-20687)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20687-applejpegdriver-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20687-applejpegdriver-uaf/High severity — binary · CVE-2026-20687. Status: PoC. Affects: AppleJPEGDriver kernel extension. Tags: ios, kernel, applejpegdriver, use-after-free, mte, iokit, kernel-panic, camera.binaryHighioskernelapplejpegdriveruse-after-freemteiokitkernel-paniccameraFirefUXSS: Universal XSS in Firefox Focus for iOS via Redirect-Scheme Validation Race Conditionhttps://poc.intelseclab.com/pocs/web/2026-06-08_firefox-focus-ios-uxss-redirect-scheme-race-condition/Mon, 08 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-06-08_firefox-focus-ios-uxss-redirect-scheme-race-condition/Critical severity (CVSS 9.3) — web. Status: Unpatched. Affects: Firefox Focus for iOS. Tags: UXSS, XSS, race-condition, TOCTOU, redirect-validation, javascript-scheme, iOS, Firefox Focus.webCriticalUXSSXSSrace-conditionTOCTOUredirect-validationjavascript-schemeiOSFirefox Focus