iOS & macOS N-day research
Latest research
CoreMedia Metric Timelines, Two Heap Bugs Reachable From an App
A sum-sized prefix table filled count times and a signed subscriber index in mediaplaybackd, the 23H24 checks, three daemon crashes from a sandboxed app on a physical iPhone, a UAF and type confusion on a research VM, and why sandbox escape is still not shown.
- Evidence
- Lab-observed
- Builds
- 23G90 → 23H24
- Apple impact
- A sandboxed process may be able to circumvent sandbox restrictions
- Published
More research
See all 3ImageIO Extended XMP Offset Wrap, a 4 GiB memcpy From a JPEG
CoreMedia “Removed the Vulnerable Code,” Tracing Three Deleted AV1 and Lens Functions
Every note shows how far its evidence got
Apple’s advisory, the patch read on both builds, then a replay on a named build. The bars show the highest level reached.