https://research.stackhopper.co/tags/dos/Recent content in Dos on Stackhopper ResearchHugoen-USStackhopper Security LLC.Thu, 03 Apr 2025 00:00:00 +0000https://research.stackhopper.co/posts/user-session-corruption-via-macos-localization-variables/Thu, 03 Apr 2025 00:00:00 +0000https://research.stackhopper.co/posts/user-session-corruption-via-macos-localization-variables/<h1 id="summary">Summary</h1> <p>macOS Sequoia 15.3.2 and lower were vulnerable to a local Denial of Service bug via a type confusion leading to a null pointer dereference by abusing the format used to store variables. This happens by setting up the <code>AppleLanguages</code> global variable, using a format for storing strings instead of the format for storing array elements; this causes the crash. The vulnerability can be triggered by opening any macOS application that either uses the <code>AppleLanguages</code> global variable, e.g. <code>System Settings.app</code>, <code>Dock.app</code> or any AppKit-based macOS application.</p>