CVE-2015-7108

macOS X < 10.11.2 - Memory Corruption via Bluetooth HCI Interface

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-7108. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a lack of bounds checking in IOBluetoothHCIUserClient's external method dispatching to achieve arbitrary kernel code execution by manipulating memory between checks. It targets a time-of-check to time-of-use (TOCTOU) vulnerability in macOS El Capitan 10.11.

Description

The Bluetooth HCI interface in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · cdososx
https://www.exploit-db.com/exploits/39372

This exploit leverages a lack of bounds checking in IOBluetoothHCIUserClient's external method dispatching to achieve arbitrary kernel code execution by manipulating memory between checks. It targets a time-of-check to time-of-use (TOCTOU) vulnerability in macOS El Capitan 10.11.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: macOS El Capitan 10.11 (15A284)
No auth needed
Prerequisites: Access to a vulnerable macOS system · Specific boot arguments (debug=0x144, pmuflags=1, kdp_match_name=en3, gzalloc_min/max)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/39372/
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034344
Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT205637

Scores

EPSS 0.0097
EPSS Percentile 77.2%

Details

CWE
CWE-119
Status published
Products (1)
apple/mac_os_x < 10.11.1
Published Dec 11, 2015
Tracked Since Feb 18, 2026