EIP-2026-104549

This exploit targets a missing sign check in IOBluetoothHCIUserClient::SimpleDispatchWL() on Mac OS X Mavericks (10.9.4/10.9.5). It leverages a kernel memory corruption vulnerability to achieve arbitrary code execution by manipulating an index value to redirect execution to a controlled memory location.