Pre-auth RCE in Apple Screen Sharing: one oversized frame to root

A pre-authentication bypass in screensharingd (macOS ≤ 26.5) chains into remote code execution as root — no password or user interaction required. The only prerequisite is that Screen Sharing is enabled on the target.

The root cause is an error-handling flaw in SRP frame-length validation. The daemon reads a 4-byte length (a successful read leaves zero in the register), and when the length is ≥ 32768, it branches to code that returns that stale zero as its status. On this path, zero means 'SRP authentication complete', so key exchange and session verification are skipped entirely. A single oversized SRP frame is enough for the server to treat the attacker as authenticated — no password or key exchange required.

After the bypass, a proprietary file-copy protocol (message type 0x22) exposes root-level file read and write access, and those writes can be leveraged for code execution. A full root shell requires SIP to be disabled; with SIP enabled (the default), the kernel refuses writes to system paths and capabilities are sharply reduced. The author published a working exploit.py; fixed in macOS 26.6.

Source: https://warez.sl0p.foo/apple-screensharing-rce/