CVE-2016-1813

HIGH

Apple iOS <9.3.2-OS X <10.11.5-tvOS <9.2.1-watchOS <2.2.1 - RCE/DoS

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-1813. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a race condition in IOAccelerator's IOAccelSharedUserClient2::page_off_resource method to achieve arbitrary kernel RIP control by dereferencing a NULL pointer. It maps the NULL page into userspace and races IOServiceClose with the vulnerable method call.

Description

The IOAccelSharedUserClient2::page_off_resource method in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · cdososx

https://www.exploit-db.com/exploits/39924

View Code ZIP pw:eip

This exploit leverages a race condition in IOAccelerator's IOAccelSharedUserClient2::page_off_resource method to achieve arbitrary kernel RIP control by dereferencing a NULL pointer. It maps the NULL page into userspace and races IOServiceClose with the vulnerable method call.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Racy

Target: Apple macOS (OS X) 10.11.4 (15E65) with IntelAccelerator

No auth needed

Prerequisites: macOS 10.11.4 with IntelAccelerator · Ability to map NULL page in userspace · Thread race condition timing

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1211 - Exploitation for Defense Evasion

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (13)

Core 13

Core References

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/39924/

Vendor Advisory x_refsource_confirm

https://support.apple.com/HT206567

Mailing List, Vendor Advisory vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2016/May/msg00004.html

Exploit, Third Party Advisory x_refsource_misc

https://bugs.chromium.org/p/project-zero/issues/detail?id=778

Vendor Advisory x_refsource_confirm

https://support.apple.com/HT206566

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/90694

Mailing List, Vendor Advisory vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2016/May/msg00003.html

Vendor Advisory x_refsource_confirm

https://support.apple.com/HT206564

Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/137400/OS-X-IOAccelSharedUserClient2-page_off_resource-NULL-Pointer-Dereference.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1035890

Mailing List, Vendor Advisory vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2016/May/msg00002.html

Vendor Advisory x_refsource_confirm

https://support.apple.com/HT206568

Mailing List, Vendor Advisory vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2016/May/msg00001.html

Scores

CVSS v3 7.8

EPSS 0.0463

EPSS Percentile 89.6%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-476

Status published

Products (4)

apple/iphone_os < 9.3.2

apple/mac_os_x < 10.11.5

apple/tvos < 9.2.1

apple/watchos < 2.2.1

Published May 20, 2016

Tracked Since Feb 18, 2026