Mac OS X and iPhone sandbox escapes
Summary: Google Project Zero published technical details of Apple bugs roughly a month after Apple released two security advisories fixing them, timing the release to give users time to patch. The disclosed bugs include heap corruptions in launchd, which runs unsandboxed and is reachable by sandboxed processes, an OS X bug allowing arbitrary kernel memory reads from within the sandbox, an integer underflow that leads the kernel to read a structure containing a function pointer from a userspace address, and four kernel NULL pointer dereferences.
What's compelling: Two of the bugs call an attacker-specified offset from a good vtable base without needing absolute kernel addresses, so they could both defeat kernel ASLR and gain kernel code execution - and the launchd corruptions sit in an unsandboxed service that sandboxed processes can talk to.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026