CTT-Apple-Silicon-Refraction

CTT-Apple-Silicon-Refraction webkitrefraction.js The 33-Layer WebGL Payload ​This JavaScript payload uses the \alpha constant to create a high-frequency "Memory Shiver." It induces the Use-After-Free UAF in CVE-2025-43529 by desynchronizing the WebKit garbage collector from the GPU's Metal comman...

Astra Linux – Vulnerability in WebKit2GTK

A type confusion issue was addressed through improved checks. This issue has been fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, and visionOS 1.0.2. Processing...

Astra Linux – Vulnerability in WebKit2GTK

“Clear History and Website Data” did not successfully clear the browsing history. The issue was resolved through improved data deletion mechanisms. This issue has been fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3, and iPadOS 14.3, as we...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fixed an issue where the BIOS boundary checking was off by one. Bounds checking during the parsing of init scripts embedded in the BIOS prevents access to the last byte. This causes driver initialization to fail on...

Astra Linux – Vulnerability in WebKit2GTK

A logic issue has been resolved through improved restrictions. This issue is fixed in iOS 16.6, iPadOS 16.6, watchOS 9.6, tvOS 16.6, and macOS Ventura 13.5. Processing web content may lead to arbitrary code execution...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Use acquire/release for the queue-enabled state. The function applenvmeinitqueue initializes the queue state and then marks the queue as enabled. The interrupt and request paths are checked before using that queue...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved memory handling. This issue is fixed in Safari 17.3, iOS 16.7.5, and iPadOS 16.7.5; iOS 17.3, and iPadOS 17.3; macOS Sonoma 14.3; tvOS 17.3; and watchOS 10.3. Processing web content may lead to arbitrary code execution...

CVE-2026-84543

Proof of concept This proof of concept is expected to kernel-panic and reboot an affected Mac. The affected test builds used during research were macOS Tahoe 26.4 25E246 and macOS 26.5 beta 4 25F5068a. Apple fixed CVE-2026-84543 in macOS Golden Gate 27, Tahoe 26.7, and Sequoia 15.8. Included PoC...

CocoaPods-RCE_CVE-2024-38366

CocoaPods-RCE This repo includes a little bit more deep dive into the research process and thoughts behind the RCE vulnerability found as part of researching and breaking the CocoaPods Package Manager. The research publication blog post can be read here:...

Exploit for Type Confusion in Apple Safari

CVE-2024-23222 PoC - Write-up: https://jamezx32.github.io/...

claude-code-macos-poc

Claude Isolation Workstation This is an experimental applicat...

Exploit for Improper Check for Unusual or Exceptional Conditions in Apple Ipados

CVE-2023-41993 PoC - Write-up: https://jamezx32.github.i...

CVE-2026-90229

A flaw was found in the Linux kernel's NVMe Apple driver. When an NVMe controller fails to initialize and is subsequently removed, the driver does not properly destroy the associated admin queue. This oversight can lead to a kernel panic, effectively causing a denial of service DoS on the affecte...

Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation

Overview This note covers differences in how TLS libraries interpret X.509 Name Constraints. A certificate that one library accepts may be rejected by another. Some of those differences are defects; others follow from behavior that RFC 5280 does not fully specify. Description The observed...

PT-2026-110468

Name of the Vulnerable Software and Affected Versions Metasploit Framework affected versions not specified Description The post module post/apple ios/gather/ios image gather contains a relative path traversal issue. The module takes file names from a Meterpreter directory listing, which can be...

frida

Frida Kit de instrumentación dinámica para desarrolladores, ingenieros inversos e investigadores de seguridad. Más información en frida.re. Dos formas de instalar 1. Instalar desde binarios precompilados Esta es la forma recomendada para comenzar. Todo lo que necesitas hacer es: pip install...

Apple’s Verified Photography System

Apple just released a system called "Reference Image." It can verify the image is exactly as taken by an iPhone--new models only--without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone. Other industry solutions require a photograph...

Apple IOKit DriverKit Race Condition

Apple IOKit contains a race condition that may allow an app to cause unexpected system termination or write kernel memory. The supplied analysis includes a sanitizer-checked proof of concept model of the reported DriverKit RPC state-handling flaw...

Apple CoreGraphics Out-Of-Bounds Write

Apple CoreGraphics contains an out-of-bounds write fixed in iOS and iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution...

Astra Linux – Vulnerability in Python 3.7

The readints function in plistlib.py in Python from version 3.9.1 is vulnerable to a potential Distributed Denial-of-Service DoS attack due to CPU and RAM exhaustion when processing malformed Apple Property List files in binary format...