EIP-2026-103408
PRE-CVEApple iOS/macOS - Sandbox Escape due to Trusted Length Field in Shared Memory used by HID Event Subsystem
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-103408. PoCs published by Google Security Research.
AI-analyzed exploit summary This exploit targets a vulnerability in the userspace IODataQueue implementation within the io_hideventsystem MIG service. By manipulating shared memory fields (length, head, tail), an attacker can cause out-of-bounds enqueuing, leading to a crash in hidd or backboardd. The PoC includes a dylib to interpose mach_vm_map and modify the shared memory fields.
Description
Apple iOS/macOS - Sandbox Escape due to Trusted Length Field in Shared Memory used by HID Event Subsystem
Exploits (1)
This exploit targets a vulnerability in the userspace IODataQueue implementation within the io_hideventsystem MIG service. By manipulating shared memory fields (length, head, tail), an attacker can cause out-of-bounds enqueuing, leading to a crash in hidd or backboardd. The PoC includes a dylib to interpose mach_vm_map and modify the shared memory fields.