137 matches found
CVE-2026-20700
dyld-signing-oracle-poc Une exploration contrôlée du mécanisme de liaison page-in et de correction chaînée de dyld en tant qu'oracle de signature PAC, dans le contexte de CVE-2026-20700. Sur arm64e, chaque pointeur de fonction est authentifié par le matériel. L'objectif ici est de montrer que dyl...
DirtySlide
DirtySlide Непривилегированный → root LPE на macOS. 8-байтовое OOB-чтение/запись в память ядра, смежную со страницей общего кэша dyld, из-за отсутствующей проверки границ внутри страницы в v5 slide walk vmsharedregionslidepagev5, доступное через syscall 536. Исправлено в macOS 26.5.2 25F84,...
SnatchBox
SnatchBox SnatchBox CVE-2020-27935 est une vulnérabilité d'évasion de la sandbox affectant macOS jusqu'à la version 10.15, ainsi que les premières versions bêta de macOS 11.0. L'impact le plus significatif de SnatchBox est qu'il permet à un éditeur malveillant de s'échapper de la sandbox non...
dyen
dyen dyen загружает Mach-O dylib в память с помощью штатного Python из macOS и вызывает экспортируемую точку входа без dlopen для этого dylib. Цель — чтобы образ никогда не существовал отдельным файлом на целевой системе и никогда не регистрировался в dyld. автор: cenobyte [email protected]...
CVE-2026-24064 Local Privilege Escalation via Dynamic Library Injection in Waves Central for macOS
Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLDINSERTLIBRARIES...
The vulnerability of the dyld component in operating systems such as iOS, iPadOS, tvOS, watchOS, and macOS allows attackers to execute arbitrary code.
The vulnerability of the dyld component in iOS, iPadOS, tvOS, watchOS, and macOS relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
PT-2026-23506
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10 Description A time-of-check-time-of-use TOCTOU issue exists in the validateScriptFileForShellBleed function. A TOCTOU issue is a software bug where a system checks a condition such as a security credential...
OpenClaw's config env vars allowed startup env injection into service runtime
Summary OpenClaw allowed dangerous process-control environment variables from env.vars for example NODEOPTIONS, LD, DYLD to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context. Details collectConfigEnvVars accepted unfiltered keys...
Apple Fixes Exploited Zero-Day Affecting iOS, macOS, and Other Devices
Apple on Wednesday released iOS, iPadOS, macOS Tahoe, tvOS, watchOS, and visionOS updates to address a zero-day flaw that it said has been exploited in sophisticated cyber attacks. The vulnerability, tracked as CVE-2026-20700 CVSS score: 7.8, has been described as a memory corruption issue in dyl...
About the security content of tvOS 26.3
About the security content of tvOS 26.3 This document describes the security content of tvOS 26.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
SUSE CVE-2026-22780
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Prior to 0.8.2, a heap overflow can be exploited when a malicious mach0 file, having bogus entries for the dyld chained segments, is parsed by rizin. This vulnerability is fixed in 0.8.2...
CVE-2026-22780 Rizin has a heap overflow on mach0_chained_fixups.c
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Prior to 0.8.2, a heap overflow can be exploited when a malicious mach0 file, having bogus entries for the dyld chained segments, is parsed by rizin. This vulnerability is fixed in 0.8.2...
CVE-2026-22780 Rizin has a heap overflow on mach0_chained_fixups.c
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Prior to 0.8.2, a heap overflow can be exploited when a malicious mach0 file, having bogus entries for the dyld chained segments, is parsed by rizin. This vulnerability is fixed in 0.8.2...
CVE-2026-22780
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Prior to 0.8.2, a heap overflow can be exploited when a malicious mach0 file, having bogus entries for the dyld chained segments, is parsed by rizin. This vulnerability is fixed in 0.8.2...
CVE-2026-22780: Allocation of Resources Without Limits or Throttling
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Prior to 0.8.2, a heap overflow can be exploited when a malicious mach0 file, having bogus entries for the dyld chained segments, is parsed by rizin. This vulnerability is fixed in 0.8.2...
CVE-2025-62686
A local privilege escalation vulnerability exists in the Plugin Alliance InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 on macOS. Due to the absence of a hardened runtime and a RESTRICT segment, a local user may exploit the DYLDINSERTLIBRARIES environment...
CVE-2025-62686
A local privilege escalation vulnerability exists in the Plugin Alliance InstallationHelper service, which is included with Plugin Alliance Installation Manager v1.4.0 on macOS . The root cause is the absence of a hardened runtime and a RESTRICT segment , allowing a local user to exploit the DYL...
CVE-2025-63744
A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load function of bindyldcache.c. Processing a crafted file can cause a segmentation fault and crash the program...
