JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201

GitHubRepository PoCWriteup

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing a zero-click PNG exploit chain for iOS 18.2.1, involving CVE-2025-43300, CVE-2025-24201, and CVE-2025-24085. It details the attack stages, indicators of compromise, and a timeline, but contains no exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a README.md documentation file describing an exploit chain. It contains no executable code, no instructions to execute anything, and no concealed payload. The text describes exploit behavior against Apple iOS, which is the stated target, and does not exhibit backdoor or deceptive behavior aimed at the reader.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
Languagesen
Target softwareiOSiPadOSmacOStvOSvisionOSwatchOSSafariWebKitCore MediaImageIOiMessage
Attack typeszero-clickremote code executionprivilege escalationsandbox escape
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that provides a narrative description of an exploit chain, including CVE identifiers, a summary, a timeline, and indicators of compromise. It does not contain any source code, scripts, or executable instructions that would constitute an exploit or a scanner. The content is purely a technical writeup.

README.md:1-108

Requirements

  • Target must be running a vulnerable version of iOS (e.g., 18.2.1) or other affected Apple operating system.README.md:8
  • Attacker must be able to deliver a malicious PNG image via iMessage to the target.README.md:19

Observed behavior

  • A malicious PNG image sent via iMessage triggers automatic parsing, leading to heap corruption.README.md:19
  • The exploit chain achieves remote code execution through WebKit.README.md:36
  • The chain performs a sandbox escape and kernel-level privilege escalation, providing root access.README.md:21
  • The attack can establish persistence, exfiltrate keychain data, and brick the device.README.md:21
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://www.virustotal.com/gui/file/f1af3b4fd9f3f08253af21e4df4ea6bb35a135df0805d176238f26de80e8d167A VirusTotal link is provided for a hash, but the hash is not present in the supplied text and the link is not an executable payload.README.md:10-11
Url
https://ia600508.us.archive.org/8/items/cve-2025-24085-24201/cve%202025-24085%3B%2024201.movA link to a video on archive.org, described as log evidence. The video content is not supplied and cannot be reviewed.README.md:25
Review boundaries

What the analysis did not establish

  • The artifact contains only a README.md file; no exploit or scanner source code is present.
  • Two binary files (CNVD certificates) are present but were not analyzed, and their content is not described in the text.
  • The analysis is based solely on the supplied text; the described exploit chain was not executed or verified.
  • Two binary files (CNVD-2025-06744 Certificate, CNVD-2025-07885 Certificate) were present in the artifact but were not inspected per binary policy.
  • One text file (likely a license or similar) was present but its content was not included in the evidence packet.
  • External links (VirusTotal, archive.org video) were not fetched or analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

3