EIP-2026-104591

This is a functional local privilege escalation exploit for macOS X xnu kernels up to version 1228.3.13. It leverages a vulnerability in workqueue_additem and workqueue_removeitem functions due to improper validation of the user-defined 'prio' parameter, combined with heap spraying via the profil syscall to achieve arbitrary kernel memory corruption and execute privileged code.