Apple Screen Sharing Pre-Auth RCE
A pre-authentication vulnerability in Apple's screensharingd daemon allows unauthenticated remote attackers to bypass SRP authentication and achieve root file read/write on macOS systems with Screen Sharing enabled. The root cause is a stale-success-status bug in the SRP frame-length validation path: when a frame length has any bit at position >= 15 set (length >= 32768), the error path returns the success code from the preceding 4-byte read instead of an error, causing the caller to treat the connection as authenticated without any key exchange or session cryptography. The attacker can then use Apple's file-copy protocol (message type 0x22) for arbitrary root file read and write. On SIP-disabled systems, crontab injection achieves code execution in approximately 60 seconds. On SIP-enabled systems (the default), /etc/zshenv and /etc/sudoers.d/ payloads execute on the next shell invocation by any user. No user interaction, password, or valid username is required; the only prerequisite is that Screen Sharing is enabled. Fixed in macOS 26.6.1, 15.7.9, and 14.8.9 (released August 6, 2026).
Research notes
- Root causeThe SRP frame-length validation in screensharingd has a stale-success-status bug: when a frame length >= 32768 is received, the error path captures the return value of the preceding 4-byte read (zero = success) instead of an error code, causing the caller to treat the connection as authenticated without any key exchange, cipher negotiation, or session cryptography.
- Exploit chainAfter the auth bypass, the attacker can use Apple's file-copy protocol (message type 0x22) for arbitrary root file read and write. On SIP-disabled systems, crontab injection achieves code execution in approximately 60 seconds. On SIP-enabled systems (the default), /etc/zshenv and /etc/sudoers.d/ payloads execute on the next shell invocation by any user.
- Technical detailNo user interaction, password, or valid username is required. The only prerequisite is that Screen Sharing is enabled on the target. The auth bypass and file read/write primitives are unaffected by SIP; the crontab-based RCE path requires SIP disabled.
- MitigationFixed in macOS 26.6.1, 15.7.9, and 14.8.9, released August 6, 2026. The fix adds proper error propagation on the frame-length validation path.