A sandboxed iOS application with only the com.apple.developer.game-center entitlement can escape the app sandbox to write files with controlled content and filenames to any location writable by the mobile user. Tested on iOS 26.4.

macOS Sequoia 15.3.2 and lower were vulnerable to a local Denial of Service bug via a type confusion leading to a null pointer dereference by abusing the format used to store variables. This happens by setting up the AppleLanguages global variable, using a …