Three Apple Ecosystem Vulnerabilities: Zero-Click Memory Corruption, iCloud Sender Spoofing, and Root Privilege Escalation

• CVE-2026-86869: Zero-Click via iMessage and OpenEXR

Researcher ironPeak discovered a heap buffer overflow in libAppleEXR.dylib: the decoder allocates 12 bytes per RGB pixel but writes 16 bytes, including an additional constant alpha channel, while the RGB data is attacker-controlled. A crafted EXR attachment is automatically processed by ImageIO after an iMessage arrives, triggering memory corruption without user interaction and outside the BlastDoor sandbox. The researcher confirmed zero-click triggering on a real iPad and demonstrated an attacker-directed write and control of the program counter in a controlled test environment. Full remote code execution on a victim device was not demonstrated: the final exploitation step was blocked by Pointer Authentication (PAC), while hardware memory tagging provided additional protection in the affected background process on the newest Apple silicon. Apple fixed CVE-2026-86869 in September 2026 across iOS, iPadOS, and macOS 27.

• Apple iCloud: Sender Spoofing While Passing SPF, DKIM, and DMARC Checks

Timo Longin of SEC Consult discovered two SMTP parsing vulnerabilities that allowed an authenticated iCloud user to send emails appearing to originate from arbitrary @icloud.com addresses. The first technique exploited inconsistent handling of carriage-return (CR) characters in the From header; the second used differences in dot-stuffing processing between Apple's SMTP parsers to manipulate how message headers and the body were interpreted. Because DKIM signatures were generated after the relevant message transformations, the spoofed emails passed SPF, DKIM, and DMARC checks, although the actual sender could still be identified in raw email headers such as Return-Path and Authentication-Results. Apple confirmed that the issues had been remediated by December 2025, and SEC Consult published the technical analysis in October 2026.

• CVE-2026-43783: Local Privilege Escalation to Root in macOS

Researcher Ilya Andr of PT SWARM discovered CVE-2026-43783 in the privileged XPC service DesktopServicesHelper: its RepairPermissionsForCloudItems handler failed to verify that supplied file paths belonged to iCloud. Through fchown(), the service could change the ownership of an attacker-specified file or directory to the requesting user's UID. In the PoC, the attacker took ownership of /private/etc/pam.d, created sudo_local containing auth sufficient pam_permit.so, and bypassed sudo password authentication to obtain root privileges. The exploit used a sandboxed application with the com.apple.security.app-sandbox and com.apple.security.temporary-exception.mach-lookup.global-name entitlements to access the XPC service. Apple's patch introduced a mandatory check for the private entitlement com.apple.private.desktopservices.cloud-repair-perm.

Article (0-click): https://ironpeak.be/blog/ex-arrr-sailing-the-0-click-seas/

Article (iCloud spoofing): https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/

Article (root): https://ptswarm.com/blog/cve-2026-43783-repair-permissions-get-root-lpe-via-desktopserviceshelper-in-macos-26-5/