https://tfp0.dev/CVE writeups for iOS and macOS. Vulnerability analysis, root causes, and patches.en-UShttps://tfp0.dev/posts/cve-2026-86876-coremedia-sandbox-write/https://tfp0.dev/posts/cve-2026-86876-coremedia-sandbox-write/Tue, 06 Oct 2026 00:00:00 +0000CVE-2026-86876 CoreMedia: a sum-sized prefix table filled count times and a signed subscriber index in mediaplaybackd, the 23H24 checks, three daemon crashes from a sandboxed app on a physical iPhone, a UAF and type confusion on a research VM, and why sandbox escape is still not shown.https://tfp0.dev/posts/cve-2026-64752-coremedia-removed-code/https://tfp0.dev/posts/cve-2026-64752-coremedia-removed-code/Tue, 06 Oct 2026 00:00:00 +0000CVE-2026-64752 CoreMedia: which code disappears between iOS 27 betas 24A5390f and 24A5408d, what the deleted AV1 frame-header parser and lens-atom writer did, why only the 27 releases are listed, and the image entry that is still open.