CoreAudio memory corruption in Apple multiple products

This repository is a proof-of-concept (POC) exploit for CVE-2025-31200, a buffer overflow in Apple's CoreAudio APAC decoder affecting iOS < 18.4.1 and macOS < 15.4.1. The exploit works by generating a malicious APAC audio cookie with mismatched channel counts (global: 4, remapping: 64), which is embedded into an audio file (MP4/M4A). When a vulnerable system processes this file (e.g., via AVAudioPlayer, browser, or email client), it triggers out-of-bounds memory access in the APACChannelRemapper::Process function, causing a crash and potential memory corruption. The repository contains Python scripts for generating the exploit payload (poc.py), creating and verifying malicious audio files (generate_audio.py, create_malicious_mp4.py, test_exploit.py), and utility modules for manipulating APAC cookies (caf_utils.py, parser.py). The exploit is primarily a Denial of Service but could be extended for code execution with advanced payloads. No network endpoints are present; the attack is delivered via crafted media files.

This repository is a proof-of-concept (POC) exploit for CVE-2025-31200, a vulnerability in Apple's CoreAudio APAC (Apple Positional Audio Codec) decoder affecting macOS (<15.4.1) and iOS (<18.4.1). The exploit demonstrates how a mismatch between the channel layout tag and the remapping array in the APAC/HOA decoder can lead to out-of-bounds reads and writes, potentially allowing for memory corruption. The repository contains: - 'encodeme.mm': The main exploit code, which crafts a malformed APAC audio file by manipulating the channel layout and remapping array. - 'build_encodeme.sh' and 'run_encodeme.sh': Scripts to build and run the exploit, the latter using LLDB to inject further memory manipulation at runtime. - 'check-mismatch.lldb' and 'run_encodeme_hook.lldb': LLDB scripts to set breakpoints and observe/control the memory state during exploitation. - 'convertme2.swift' and 'getaudiolength.swift': Swift utilities for converting audio and checking file properties. - 'apac.ksy': Kaitai Struct definition for the APAC format, useful for understanding and manipulating the binary structure of APAC files. The exploit is not fully weaponized; it is a research POC that demonstrates the bug and provides a controlled (but not fully arbitrary) write. It requires manual steps and a vulnerable system. No network endpoints are involved; the attack vector is local, requiring the ability to run code and debug on the target system.