EIP-2026-116804

PRE-CVE

Apple QuickTime - QuickTime.util.QTByteObject Initialization Security Checks Bypass

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-116804. PoCs published by Security Explorations.

AI-analyzed exploit summary This exploit bypasses security checks in Apple QuickTime Java extensions by manipulating the QTByteObject initialization. It demonstrates arbitrary code execution by launching notepad.exe and creating a file, leveraging an undisclosed Oracle Issue 15.

Description

Apple QuickTime - QuickTime.util.QTByteObject Initialization Security Checks Bypass

Exploits (1)

exploitdb WORKING POC
by Security Explorations · textlocalwindows
https://www.exploit-db.com/exploits/19401

This exploit bypasses security checks in Apple QuickTime Java extensions by manipulating the QTByteObject initialization. It demonstrates arbitrary code execution by launching notepad.exe and creating a file, leveraging an undisclosed Oracle Issue 15.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Apple QuickTime Java extensions (QTJava.zip)
No auth needed
Prerequisites: Java Runtime Environment (JRE) with QTJava.zip in the classpath · Manual addition of Vuln22Setup.class and Vuln22Setup$1.class to QTJava.zip
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026