Sandbox escape via GameKit and cfprefsd | CVE-2026-64740
Summary
A sandboxed iOS application with only the com.apple.developer.game-center entitlement can escape the app sandbox to write files with controlled content and filenames to any location writable by the mobile user. Tested on iOS 26.4.
Explanation
The cacheImageData:inSubdirectory:withFileName:handler: method on gamed’s GKDaemonProxy (via the GKUtilityService XPC endpoint) writes data to /var/mobile/Library/Caches/GameKit/Images/<subdirectory>/<fileName>. Neither the subdirectory or the fileName parameters are validated for path traversal payloads.
By sending a raw XPC message directly to gamed via GKDaemonProxy, a third-party sandboxed iOS app causes gamed (which runs as mobile outside the app sandbox) to write attacker-controlled data with a desired filename to a path outside the sandbox’s reach. No GameKit authentication is required.
Root cause
The write path in gamed (-[NSData(GKDaemonAdditions) _gkWriteToImageCacheWithURLString:]) performs zero path sanitization. It takes a URL string, converts it to a filesystem path, creates intermediate directories via createDirectoryAtPath:withIntermediateDirectories:YES, and writes data using writeToFile:options:error with the NSDataWritingAtomic type.
A containsString:@"../" check exists in gamed, but it only applies to the read path (the block handling loadCachedImageDataFromSubdirectory:withFileName:handler:). The single ../ CFString constant at offset 0x10038d600 in the iOS 26.4 gamed binary is referenced exclusively from the read handler. The write, delete, and cachePhotos paths have no traversal check whatsoever.