Loading vulnerability…
CVE-2022-26766 is a certificate parsing vulnerability affecting multiple Apple platforms, including tvOS, iOS, iPadOS, macOS, and watchOS. The flaw allows a malicious application to bypass signature validation due to insufficient checks during certificate parsing. This could enable unauthorized code execution or privilege escalation by circumventing code signing protections.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a proof-of-concept (POC) exploit for CVE-2022-26766, a vulnerability in Apple's CoreTrust framework that allows any root certificate to be trusted, bypassing Apple's certificate trust model. The repository contains: - Multiple directories with scripts and files to generate fake certificate chains (root, intermediate, and developer certificates) for both generic and iPhone-specific use cases. These are used to sign code in a way that would be accepted by vulnerable versions of CoreTrust. - Objective-C source files (`littlect.m`, `littlemis.m`) that demonstrate how to validate code signatures and interact with CoreTrust/MIS APIs, showing how the fake certificates can be used to bypass signature checks. - A privilege escalation demo (`spawn_root.m` and `spawn_root.entitlements`) that uses macOS persona APIs to spawn a process as root, which could be signed with the fake certificates to bypass code signing restrictions. - Build scripts for compiling the demo binaries and generating certificates. The main exploit capability is to demonstrate that, due to the CoreTrust bug, code signed with any root certificate (not just Apple's) can be accepted as valid, enabling code signing bypass and potential privilege escalation. The repository provides all necessary materials to reproduce the issue, including fake certificates and code to validate or exploit the bypass. The attack vector is local, as the attacker needs to run or inject code on the target device. No network endpoints are involved, but several file-based endpoints (certificate and entitlement files) are fingerprintable.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.