[CVE Pending] WebKit JSC Integer Overflow – OOB Write via Gigacage (iOS 26.2) --------------------------------------------------------------------Full advisory, PoC, and logs: [https://github.com/JGoyd/0day-GigaCage-Webkit] -------------------------------------------------------------------- 1. Executive Summary
A critical vulnerability exists in the WebKit JavaScriptCore (JSC) engine. Integer overflow in memory offset calculations for ArrayBuffer, TypedArray, and WebAssembly enables out-of-bounds (OOB) memory access. Gigacage currently mitigates this via process termination, but the underlying logic flaw could be used for remote code execution if combined with a mitigation bypass.
-------------------------------------------------------------------- 2. Environment Details
OS: iOS 26.2 (Build 23C55) WebKit: 8623.1.14.10.9 Crash: EXCGUARD (Namespace 31: Gigacage Primitive Partition) Offset: 0xADD7476C Device: iPhone 15,3 (iPhone 14 Pro Max) UUID: af25fa78-ae3e-3bf4-b320-4404d3a36a77
-------------------------------------------------------------------- 3. Technical Analysis (CWE-190)
Vulnerability occurs during offset calculation for TypedArray and DataView. If 'index elementSize' wraps at the 32-bit boundary, the overflowed value can pass initial bounds checks. When added to the Gigacage base pointer, this can exceed the 16GB boundary, triggering a guard violation.
The flaw is also reachable via the WebAssembly JIT, which may elide bounds checks; wraparound in 32-bit arithmetic permits unsanitized JITed memory access.
-------------------------------------------------------------------- 4. Proof of Concept (PoC)
JavaScript (DataView vector):
const buffer = new ArrayBuffer(1024); const view = new DataView(buffer); // 0xFFFFFFFE + 4 wraps at 32-bits view.setUint32(0xFFFFFFFE, 0x41414141);
WebAssembly (JIT vector):
;; (i32.add (i32.const 0xFFFFFFFF) (i32.const 0x5)) wraps to 0x4 (i32.load offset=0)
Reproduction Steps:
1. Host PoC HTML on HTTPS server. 2. Access with Mobile Safari on iOS 26.2. 3. Observe termination of WebContent process. 4. Confirm offset 0xADD7476C in crash log.
-------------------------------------------------------------------- 5. Remediation
Implement checked arithmetic in the following components:
- Source/JavaScriptCore/runtime/JSArrayBufferView.cpp - Source/JavaScriptCore/runtime/JSDataView.cpp
Proposed fix:
sizet byteOffset; if (builtinmuloverflow(staticcast<sizet>(index), melementSize, &byteOffset)) { return throwOverflowError(); }
-------------------------------------------------------------------- 6. Supporting Evidence
Consistent crash offset and namespace 31 violation found in:
ExcUserFaultMobileSafari-2025-12-25-131432.ips ExcUserFaultSafariViewService-2025-12-25-062945.ips
-------------------------------------------------------------------- 7. Disclosure
Apple Security is being notified at the same time as this public mailing list post, as they are CC'd on this email. This is not a coordinated disclosure; notification to Apple and the broadercommunity is occurring simultaneously. -------------------------------------------------------------------- 8. Legal Disclaimer
Provided for authorized security research only. Unauthorized use is prohibited and may be unlawful.
--------------------------------------------------------------------
Thank you, Joseph Goydish II
Processing web content may lead to a denial-of-service. The issue was addressed with improved memory handling. WebKit Bugzilla: 263758
A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request.
Memory corruption in DSP Services during a remote call from HLOS to DSP.
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTLKGSLGPUAUXCOMMAND.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.
A vulnerability has been found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /authorposts.php. The manipulation of the argument author with the input g6g12<script>alert(1)</script>o8sdm leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233293 was assigned to this vulnerability.
CVE-2023-28205 (WebKit)
It is a use-after-free vulnerability that allows attackers to process maliciously crafted web content that may lead to arbitrary code execution.
By tricking targets into loading malicious websites under the control of attackers, it is possible to exploit the vulnerability, which could lead to the execution of malware on compromised systems. Maliciously designed web content can cause the execution of arbitrary code, giving attackers access to your device without your knowledge. Apple has fixed this vulnerability with improved memory management.
WebKit Bugzilla: 254797
https://seclists.org/fulldisclosure/2023/Apr/1 https://seclists.org/fulldisclosure/2023/Apr/2 https://seclists.org/fulldisclosure/2023/Apr/3
WebKit. Multiple memory corruption issues were addressed with improved memory handling.
WebKit. Multiple memory corruption issues were addressed with improved memory handling.
WebKit. Multiple memory corruption issues were addressed with improved memory handling.
WebKit. Multiple memory corruption issues were addressed with improved memory handling.
An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
WebKit. Multiple memory corruption issues were addressed with improved memory handling.
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.