Security research for the ever-curious

A type confusion between the ASN.1 BOOLEAN and INTEGER values in the DER entitlement processing functions amfid uses allows macOS applications to claim boolean entitlements, such as com.apple.security.app-sandbox, using the <integer>1</integer> …

A sandboxed iOS application with only the com.apple.developer.game-center entitlement can escape the app sandbox to write files with controlled content and filenames to any location writable by the mobile user. Tested on iOS 26.4.

macOS Sequoia 15.3.2 and lower were vulnerable to a local Denial of Service bug via a type confusion leading to a null pointer dereference by abusing the format used to store variables. This happens by setting up the AppleLanguages global variable, using a …