CVE-2022-26766

MEDIUM

tvOS <15.5-iOS <15.5- iPadOS <15.5 - Signature Validation Bypass

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-26766. PoCs published by zhuowei.

AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2022-26766, demonstrating how to exploit the CoreTrust bug to sign arbitrary code with a fake root certificate. It includes scripts to generate malicious certificates and build signed binaries.

Description

A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A malicious app may be able to bypass signature validation.

Exploits (1)

nomisec WORKING POC 88 stars

by zhuowei · poc

https://github.com/zhuowei/CoreTrustDemo

View Code ZIP pw:eip

This repository contains a proof-of-concept for CVE-2022-26766, demonstrating how to exploit the CoreTrust bug to sign arbitrary code with a fake root certificate. It includes scripts to generate malicious certificates and build signed binaries.

Classification

Working Poc 95%

Attack Type

Auth Bypass

Complexity

Moderate

Reliability

Reliable

Target: Apple macOS CoreTrust (versions affected by CVE-2022-26766)

No auth needed

Prerequisites: OpenSSL for certificate generation · Apple development tools for code signing

MITRE ATT&CK

T1553.006 - Code Signing Policy Modification

devstral-2 · analyzed Feb 16, 2026 Full analysis →