Macos on Stackhopper Research

Sandbox evasion via CoreEntitlements type confusion

Sun, 29 Mar 2026 00:00:00 +0000

Summary

A type confusion between the ASN.1 BOOLEAN and INTEGER values in the DER entitlement processing functions amfid uses allows macOS applications to claim boolean entitlements, such as com.apple.security.app-sandbox, using the <integer>1</integer> expression instead of <true/>. On macOS 26.3.1, the entitlement passes all validation stages (codesign, both amfid’s anomaly detection and compareToCFRepr checks) and only then the kernel’s entitlement enforcement (IOTaskHasEntitlement, Sandbox.kext) rejects it due to a stricter DER tag check.

Denial of Service via macOS localization variables | CVE-2025-24199

Thu, 03 Apr 2025 00:00:00 +0000

Summary

macOS Sequoia 15.3.2 and lower were vulnerable to a local Denial of Service bug via a type confusion leading to a null pointer dereference by abusing the format used to store variables. This happens by setting up the AppleLanguages global variable, using a format for storing strings instead of the format for storing array elements; this causes the crash. The vulnerability can be triggered by opening any macOS application that either uses the AppleLanguages global variable, e.g. System Settings.app, Dock.app or any AppKit-based macOS application.