CoreMedia · file descriptors
The published app reads a daemon-opened descriptor while its direct open of the same path is denied. The demonstrated access is centered on the media library.
- Capability
- Limited file read
- Device & build
- Reported tests: iOS 26.5 (23F77), 27.0 (24A437), 27.0.1 (24A446)
- Primary artifact
- Source + logs
- Published
- Reviewed
Observed
- The PoC asks mediaplaybackd to open a client-selected path and obtains a live file descriptor in the reply.
- Source and supplied logs show reads through that descriptor, including SQLite content, alongside a denied direct-open control.
- The tested accessible domain centers on the media library. Tested protected paths and writes remain denied.
Assessment
This is a completed, bounded access-control violation in the supplied evidence. The service acts with authority the client lacks, but receiving a descriptor does not grant general control of the service or change the client’s sandbox policy.
Limits
- The publication does not establish general filesystem access, service-process execution, or kernel access.
- The path survey is bounded; it is not an exhaustive map of every readable or denied file.
- The author reports an independent duplicate disclosure. Apple’s advisory credit is not independent validation of this repository’s reproduction.
- The issue is reported fixed in iOS 26.7.2 and 27.2.