Out-of-bounds Write Denial-of-Service in Apple Operating Systems

This repository is a small, self-contained proof-of-concept for CVE-2026-64725, an Apple AudioToolboxCore AIFF parsing vulnerability affecting macOS/iOS/iPadOS versions before 26.6. The repo contains four files: a README with reproduction steps and crash output, a Makefile for building the harness and regenerating the sample file, a Python generator that creates a malformed AIFF, and a C harness that exercises the vulnerable public AudioFile API. The exploit capability is limited to local/file-based triggering of an out-of-bounds write. The Python script generates marker_oob.aiff by crafting an AIFF MARK chunk whose declared marker count has the sign bit set (0x8000), while only 64 minimal marker entries are actually present. The C harness then opens the file with AudioFileOpenURL and calls AudioFileGetProperty with kAudioFilePropertyMarkerList, supplying a deliberately undersized heap buffer. According to the README and code comments, the underlying undocumented function AIFFAudioFile::GetMarkerList misinterprets the output size and continues writing 40-byte AudioFileMarker records past the end of the caller buffer, causing heap corruption and an ASan-detectable crash. There is no network behavior, no command execution payload, no persistence, and no attempt to gain code execution. This is a reproducible crash/memory-corruption PoC rather than a weaponized exploit. The repository structure is straightforward: poc/gen_marker_oob_aiff.py creates the malformed input, poc/marker_oob_harness.c is the runtime trigger, and poc/Makefile builds both. The overall purpose is vulnerability reproduction and validation, not exploitation beyond demonstrating the memory safety flaw.