Stackhopper Research

Sandbox evasion via CoreEntitlements type confusion

Sun, 29 Mar 2026 00:00:00 +0000

Summary

A type confusion between the ASN.1 BOOLEAN and INTEGER values in the DER entitlement processing functions amfid uses allows macOS applications to claim boolean entitlements, such as com.apple.security.app-sandbox, using the <integer>1</integer> expression instead of <true/>. On macOS 26.3.1, the entitlement passes all validation stages (codesign, both amfid’s anomaly detection and compareToCFRepr checks) and only then the kernel’s entitlement enforcement (IOTaskHasEntitlement, Sandbox.kext) rejects it due to a stricter DER tag check.

Sandbox escape via GameKit and cfprefsd | CVE-2026-64740

Wed, 25 Mar 2026 00:00:00 +0000

Summary

A sandboxed iOS application with only the com.apple.developer.game-center entitlement can escape the app sandbox to write files with controlled content and filenames to any location writable by the mobile user. Tested on iOS 26.4.

Explanation

The cacheImageData:inSubdirectory:withFileName:handler: method on gamed’s GKDaemonProxy (via the GKUtilityService XPC endpoint) writes data to /var/mobile/Library/Caches/GameKit/Images/<subdirectory>/<fileName>. Neither the subdirectory or the fileName parameters are validated for path traversal payloads.

By sending a raw XPC message directly to gamed via GKDaemonProxy, a third-party sandboxed iOS app causes gamed (which runs as mobile outside the app sandbox) to write attacker-controlled data with a desired filename to a path outside the sandbox’s reach. No GameKit authentication is required.

Denial of Service via macOS localization variables | CVE-2025-24199

Thu, 03 Apr 2025 00:00:00 +0000

Summary

macOS Sequoia 15.3.2 and lower were vulnerable to a local Denial of Service bug via a type confusion leading to a null pointer dereference by abusing the format used to store variables. This happens by setting up the AppleLanguages global variable, using a format for storing strings instead of the format for storing array elements; this causes the crash. The vulnerability can be triggered by opening any macOS application that either uses the AppleLanguages global variable, e.g. System Settings.app, Dock.app or any AppKit-based macOS application.