How to unc0ver a 0-day in 4 hours or less

Summary: On May 23, 2020, the unc0ver jailbreak shipped for iOS 13.5 using a zero-day and heavy obfuscation; Project Zero's Brandon Azad identified the bug by 7 PM that day and sent Apple a POC and analysis by 1 AM. Killing the app mid-jailbreak produced a kernel panic showing a use-after-free in kalloc.16, and further testing traced the flaw to the lio_listio() syscall and the aio_lio_context object from the earlier LightSpeed bug.
Key Takeaway: The bug was a reintroduced LightSpeed flaw that a simple regression test would have caught, and Azad's point is that obfuscating an exploit does little to keep the bug out of the hands of bad actors.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026