CVE-2026-43813

KO | EN

gitlite — search

#macos #computer-vision #ai-agents #kotlin #large-language-models #framework #chatbot #awesome #chatgpt #openai

(★ 9)

CVE-2026-43813: CloudAttestation enforceEnvironment bypass

File Explorer

ZIP Download

.gitignore
23G5057c_CloudAttestation
23G5065a_CloudAttestation
23G5065a_CloudAttestation_vs_23G5057c_CloudAttestation.BinDiff
CVE-2026-43813.txt
NOTES.md
notes.txt
README.md
releases.txt
WHY-NOT-SIDELOADING.md
WRITEUP.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Reverse-engineered analysis of the PCC attestation input-validation bug
Apple shipped as iOS 26.6, found in `CloudAttestation.dylib`.

## TL;DR

`PCC.ComputeNodeValidator.policy.getter` reads the
`com.apple.CloudAttestation.environment` byte from the unverified
**darwinInit** dictionary inside the `AttestationBundle` protobuf and
stuffs it straight into the `NodeValidator.policy` returned to the caller.
The 26.6 fix introduces a new struct field that is supposed to gate that
read on the system policy key `enforceEnvironment` in the
`com.apple.CloudAttestation` domain — but that field was **never
initialised in 26.5**, so the gate was effectively absent and a crafted
PCC attestation bundle could set an attacker-chosen environment value into
the validator's policy chain.

The byte itself doesn't unlock anything by itself — it has to match the
caller-supplied `expected` parameter to pass `EnvironmentPolicy.evaluate`,
and the rest of the production policy stack (`requireProdTrustAnchors`,
`requireProdFusing`, `requireLockedCryptexes`, `restrictDeveloperMode`,
`strictCertificateValidation`, `transparencyProofValidation`,
`ensembleTopologyValidation`) is read from `os_policy_lookup`, not from
the bundle.

## Binaries included in the repo

| Build | Path | Role |
|---|---|---|
| 23G5057c | `23G5057c_CloudAttestation` | 26.6 beta 4 (**vulnerable**) |
| 23G5065a | `23G5065a_CloudAttestation` | 26.6 beta 5 (**patched**) |
| — | `23G5065a_CloudAttestation_vs_23G5057c_CloudAttestation.BinDiff` | The diff between them |

IDA databases (`.i64`), BinExport dumps, and other in-between builds are
gitignored.

## Vulnerable / patched addresses

| Symbol | 23G5057c (vuln) | 23G5065a (patched) |
|---|---|---|
| `PCC.ComputeNodeValidator.policy.getter` | `0x235e16f5c` (0x1c4) | `0x235e02fa8` (0x1dc) |
| `PCC.ComputeNodeValidator.init(proxyingAttestation:)` | `0x235e15ca0` | `0x235e01bf4` |
| Init `enforceEnvironment` lookup helper | *(missing)* | `0x235ed01cc` |
| `DarwinInit.environment.getter` | `0x235edc880` | same |

Bindiff similarity for the patched pair: **0.68**.

## Files

- [WRITEUP.md](WRITEUP.md) — full reverse-engineering writeup (data flow,
  fix patch, why it's PCC-internal not app-signing-internal)
- [WHY-NOT-SIDELOADING.md](WHY-NOT-SIDELOADING.md) — short threat-model
  coda explaining why this CVE can't be turned into a
  TrollStore-style exploit
- [NOTES.md](NOTES.md) — analysis scratchpad
- `CVE-2026-43813.txt` — original CVE description (verbatim from VulDB)
- `releases.txt` — build IDs in chronological order

## Note

This research was heavily assisted by MiniMax-M3.
Keep that in mind when reading the writeups — none of the analysis is
independently verified, and any quoted decompilation, address, or
similarity score should be re-checked before relying on it.

CVE-2026-43813

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README