eddinos2/cve-2026-64747Root-cause analysis and reachability PoC for CVE-2026-64747, a buffer overflow in the AppleAVE2 kernel extension. Includes reversed IOKit wire protocol, overflow math, and a userspace PoC driving the configure path.
Root-cause analysis and macOS reachability proof-of-concept for
CVE-2026-64747, a buffer overflow in the AppleAVE2 video encoder kernel
extension (com.apple.driver.AppleAVE2) fixed in macOS 26.6 (kext 905.40.1).
AppleAVE2 — Impact: an app may be able to execute arbitrary code with kernel privileges. A buffer overflow in the encoder's work-buffer size calculation was addressed with improved bounds checking.
This repository documents the fully reversed IOKit wire protocol of
AppleAVE2UserClient (create session → configure → per-frame process), the
exact overflow site (a 32-bit LRB work-buffer size calculator in the HEVC
10-bit multipass path), and a userspace PoC that opens the user client, drives
the configure path through the kernel's validation stack, and demonstrates the
differential between vulnerable (905.36.1) and fixed (905.40.1) builds.
Tier (honest): reachability + full protocol RE + analytically proven overflow math. Not RCE, no live overflow demonstrated — the lab host runs the fixed kext, and a hardware capability gate (present in both builds) rejects the overflowing dimensions before the vulnerable calculator runs. Firing the overflow needs a target whose capability table admits the required dimensions (see FIRE_READY.md §5-6).
| file | what |
|---|
poc_ave2_reach.c | IOKit userspace PoC: opens AppleAVE2UserClient, creates a session, drives configure with the reversed structs. No entitlements needed. |
ave2_wire.h | The reversed wire format: selector numbers, struct sizes, and every field offset that matters (width/height, encType, views/layers, chroma, bit depth) |
WIRE_FORMAT.md | Wire-format reference: dispatch table layout, PAC quirk, per-selector contracts |
FIRE_READY.md | The overflow math (mode-5 LRB calculator), the exact input to trigger it, patched-host run evidence, and the remaining unknowns |
evidence/ | ioreg capture + kernel logs from the patched-host runs (validation-stack progression) |
clang -O0 -g -arch arm64 -framework IOKit -framework CoreFoundation \
-o poc_ave2_reach poc_ave2_reach.c
./poc_ave2_reach # root not required; service opens from user context
AppleAVE2's encoder computes an LRB (lookaside reference buffer) work-buffer
size with 32-bit arithmetic and no overflow check. In the HEVC 10-bit
multipass path (calculator invoked with param_2 = 5), dimensions such as
64656×8080 (which pass the driver's w*h ≤ 0x1FFE0000 clamp) make the
component sum 0x80000000 — sign bit set. The vulnerable calculator returns
the bare 32-bit sum; the size is treated as negative downstream, an
undersized DART/IOMMU buffer is allocated, and the encoder DMA writes past
it → kernel heap/DART corruption → kernel code execution. The fixed
calculator adds per-component sign checks and a 64-bit sum check and logs
LRB size overflow.
__const section (rows of
stride 0x18 = {func, inSize<<32, outSize<<32}, with a PAC pointer quirk).IOServiceOpen must use type=1 (type=0 → create rejected).IOConnectCallAsyncStructMethod (the sync path is rejected at the
IO_Config:337 gate before validation).For educational and defensive research purposes. The bug is patched in current macOS; test only on hardware you own.