Loading vulnerability…
CVE-2026-43655 is an out-of-bounds read vulnerability in Apple IOSurfaceAccelerator. The flaw was addressed through improved bounds checking. A malicious application running on an affected device may be able to trigger the condition, resulting in unexpected system termination or disclosure of kernel memory. The issue affects Apple platforms including iOS, iPadOS, macOS, tvOS, and watchOS prior to the fixed releases.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains three standalone Xcode iOS PoC apps plus CI packaging workflow and documentation. The primary purpose is security research and reproduction of Apple kernel/driver vulnerabilities reachable from a normal app context. Structure: UAFPoc/, AOPPanicPoc/, and M2ScalerPoC/ each contain a minimal Xcode project, Info.plist, and a single Objective-C main.m implementing the PoC logic. .github/workflows/build.yml builds unsigned IPAs for all three apps on macOS runners. README.md documents CVE-2026-28992 in detail and also references the AppleM2ScalerCSCDriver issues. Main exploit capabilities: 1) UAFPoc targets CVE-2026-28992 in IOHIDFamily FastPathUserClient. It crafts an XML property list containing FastPathHasEntitlement and FastPathMotionEventEntitlement to satisfy gate/open checks, opens 15 connections to IOHIDEventService, then races one thread repeatedly calling selector 1 (close) and selector 0 (reopen/gate) against eight threads repeatedly calling selector 2 (copyEvent) on other connections. The intended result is a provider-side use-after-free leading to kernel panic/reboot. 2) AOPPanicPoc also targets CVE-2026-28992 but exercises a different race: multiple persistent connections are gated, opener threads continuously close/reopen them, and the main thread repeatedly opens batches of probe connections and destroys their Mach ports with mach_port_destroy to trigger asynchronous didTerminate/teardown while other threads are reopening. The comments state this can free provider-facing state concurrently and saturate SPU/AOP mailbox handling, causing an AOP watchdog timeout and device reboot. 3) M2ScalerPoC targets AppleM2ScalerCSCDriver and appears to combine vulnerability research for CVE-2025-43510 and CVE-2026-43655. It opens the AppleM2ScalerCSCDriver service (trying userType 0 and 1), probes selectors 0-15 with zeroed input to map the attack surface, performs a boundary sweep for an alleged OOB read using crafted MultiPlaneDescriptor structures on methods 5-7, and then launches a COW race phase that may reboot the device. Unlike the IOHID PoCs, this one logs detailed output to Documents/poc_log.txt. No network C2, remote delivery, or exfiltration behavior is present. The attack vector is local-only: the code must run as an app on a vulnerable iOS device. The repository is a real exploit/PoC set rather than a detector; however, it is destructive in the sense that successful exploitation causes kernel panic and reboot rather than privilege escalation or shell access.
Repository is a small, self-contained Objective-C proof-of-concept for CVE-2026-43655, an AppleM2ScalerCSCDriver / IOSurfaceAccelerator use-after-free reachable from a default iOS app sandbox. Structure is minimal: README.md provides the technical write-up and reproduction steps, ScalerTeardownUAF.m contains the full exploit logic and iOS UI wrapper, and entitlements.plist contains only get-task-allow for signing. The code is not part of a larger exploit framework. The main exploit flow is implemented in ScalerTeardownUAF.m inside UAFVC::runUAF. It obtains the AppleM2ScalerCSCDriver service with IOServiceGetMatchingService, opens a victim connection with IOServiceOpen, creates source and destination IOSurface objects, and submits a synchronous baseline request via IOConnectCallMethod selector 1. It then sets a victim marker value 0xDEAD0001 using selector 10, submits 50 asynchronous operations by setting TSD offset 0x008 to 1, and closes the victim connection with IOServiceClose. After teardown, it opens 50 replacement spray connections to the same driver, sets each spray connection marker to 0xBEEF0002 via selector 10, and repeatedly submits additional async operations to encourage allocator reuse and scheduler activity. The exploit capability is to reliably prime a stale scheduler entry in a shared kernel scheduler and demonstrate that the scheduler later dereferences freed-and-reused operation memory. The intended observable is a panic/reboot where register x9 contains 0xBEEF0002, proving the scheduler read replacement connection data rather than the original victim marker. The README further explains that the actual trigger may occur later when SpringBoard/compositor activity drives another scaler scheduling cycle, making this a cross-connection and potentially cross-process trigger condition. No network communication, remote C2, or external URLs are present. The relevant fingerprintable targets are local IOKit service names, bundle identifiers, and build/package file paths. Overall, this is a genuine local kernel crash/UAF reproduction PoC focused on demonstrating memory lifetime corruption rather than achieving privilege escalation or code execution.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in IOSurfaceAccelerator that may allow an app to cause unexpected system termination or read kernel memory.
An out-of-bounds read vulnerability in macOS Tahoe that may allow an app to cause unexpected system termination or read kernel memory.
An out-of-bounds read vulnerability in Apple TV software that could cause system termination or allow reading kernel memory.
An out-of-bounds read vulnerability that could allow an app to crash the system or read kernel memory.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.