Macos — PoC Archivehttps://poc.intelseclab.com/tags/macos/Latest proof-of-concept entries.Hugoen-usSat, 15 Aug 2026 00:00:00 +0000Docker — CopyEscape: Container-to-Host Escape via docker cp Race Condition (CVE-2026-17106)https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-17106-copyescape-docker-cp-host-takeover/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-17106-copyescape-docker-cp-host-takeover/Critical severity (CVSS 9.8) — binary · CVE-2026-17106. Status: Patched. Affects: Docker Engine / Docker Desktop, docker cp CLI command. Tags: docker, container-escape, race-condition, symlink, path-traversal, runc, host-takeover, linux, macos, CWE-367, CWE-59, CVE-2026-17106.binaryCriticaldockercontainer-escaperace-conditionsymlinkpath-traversalrunchost-takeoverlinuxmacosCWE-367CWE-59CVE-2026-17106Dolby Unified (DDPlus) Decoder Out-of-Bounds Write via Evolution Data (CVE-2025-54957)https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-54957-dolby-decoder-oob-write/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-54957-dolby-decoder-oob-write/Critical severity (CVSS 9.8) — binary · CVE-2025-54957. Status: Weaponized. Affects: Dolby Digital Plus (DDPlus) Unified Decoder — bundled in Android media stack, iOS/macOS CoreAudio-adjacent decoders, and ChromeOS. Tags: dolby, ddplus, ac-3, ec-3, audio-codec, out-of-bounds-write, integer-overflow, zero-click, android, ios, macos, heap-corruption.binaryCriticaldolbyddplusac-3ec-3audio-codecout-of-bounds-writeinteger-overflowzero-clickandroidiosmacosheap-corruptionXNU PF_ROUTE RTA_GENMASK Heap Buffer Overflow (CVE-2026-20698)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20698-xnu-pf-route-heap-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20698-xnu-pf-route-heap-overflow/High severity — binary · CVE-2026-20698. Status: PoC. Affects: XNU kernel routing socket subsystem (PF_ROUTE, bsd/net/rtsock.c / bsd/net/radix.c). Tags: xnu, kernel, ios, macos, pf_route, routing-socket, heap-overflow, radix-tree, kernel-panic, bounds-safety.binaryHighxnukerneliosmacospf_routerouting-socketheap-overflowradix-treekernel-panicbounds-safetyExifTool Metadata Field Command Injection (macOS) — CVE-2026-3102https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3102-exiftool-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-3102-exiftool-command-injection/High severity — binary · CVE-2026-3102. Status: PoC. Affects: ExifTool. Tags: exiftool, command-injection, macos, metadata, reverse-shell, tagsfromfile, perl.binaryHighexiftoolcommand-injectionmacosmetadatareverse-shelltagsfromfileperlAppleSEPKeyStore IOKit Use-After-Free (CVE-2026-20637)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20637-applesepkeystore-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20637-applesepkeystore-uaf/High severity — binary · CVE-2026-20637. Status: PoC. Affects: AppleSEPKeyStore driver (com.apple.driver.AppleSEPKeyStore, exposed as IOKit service AppleKeyStore). Tags: ios, macos, kernel, iokit, use-after-free, race-condition, aksepkeystore, xnu, kernel-panic.binaryHighiosmacoskerneliokituse-after-freerace-conditionaksepkeystorexnukernel-panicAppleM2ScalerCSCDriver Shared Scheduler Use-After-Free (CVE-2026-43655)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43655-apple-m2-scalercscdriver-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43655-apple-m2-scalercscdriver-uaf/High severity — binary · CVE-2026-43655. Status: PoC. Affects: Apple AppleM2ScalerCSCDriver kext / IOSurfaceAcceleratorClient user-client (iOS, iPadOS, macOS on Apple M2-family scaler hardware). Tags: use-after-free, ios, ipados, macos, kernel, iokit, iosurface, kext, sandbox-escape-adjacent, memory-corruption.binaryHighuse-after-freeiosipadosmacoskerneliokitiosurfacekextsandbox-escape-adjacentmemory-corruptionClaude Desktop Cowork VM Image Integrity Bypass / Local Persistence (CVE-2026-7574)https://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-7574-claude-desktop-cowork-vm-bypass/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-7574-claude-desktop-cowork-vm-bypass/High severity (CVSS 8.7) — binary · CVE-2026-7574. Status: PoC. Affects: Anthropic Claude Desktop — Cowork feature. Tags: LPE, persistence, VM-integrity, rootfs, Claude, AI-application, macOS, ext4, integrity-bypass, Shell.binaryHighLPEpersistenceVM-integrityrootfsClaudeAI-applicationmacOSext4integrity-bypassShellAdobe Acrobat/Reader Prototype Pollution Sandbox Escape (CVE-2026-34621)https://poc.intelseclab.com/pocs/binary/2026-05-16_adobe-acrobat-prototype-pollution-sandbox-escape/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-16_adobe-acrobat-prototype-pollution-sandbox-escape/Critical severity (CVSS 9.8) — binary · CVE-2026-34621. Status: Weaponized. Affects: Adobe Acrobat DC / Adobe Acrobat Reader DC / Adobe Acrobat 2024 JavaScript engine sandbox boundary. Tags: prototype-pollution, sandbox-escape, Adobe-Acrobat, Adobe-Reader, PDF, RCE, Windows, macOS, user-interaction.binaryCriticalprototype-pollutionsandbox-escapeAdobe-AcrobatAdobe-ReaderPDFRCEWindowsmacOSuser-interaction