LinkPresentation · HEIC
A detailed report connects received-link delivery to an out-of-bounds clear and draw. Neighboring-buffer writes add substance beyond the crash, with destination control still limited.
- Capability
- Neighboring-buffer corruption
- Device & build
- Detailed reproduction: macOS 26.7 (25G229); iPhone testing also reported
- Primary artifact
- Source + report
- Published
- Reviewed
Observed
- LinkPresentation sizes a pixel buffer from the first image frame, then uses a later decoded frame’s dimensions for drawing.
- The report documents an out-of-bounds clear, image-content writes, and changes to a neighboring live IOSurface. It also includes controls and a patched-build comparison.
- Received-link testing reaches the affected transcoder after the recipient loads the Messages preview. Source was published October 29; the detailed report followed October 30.
Assessment
This is a strong public disclosure because it connects external delivery, a specific allocation mistake, and measured corruption. The input influences the overflow and contents; allocation layout determines the neighboring target.
Limits
- No arbitrary-address write or code-execution chain is published.
- The reported Messages trigger requires loading the preview. It should not be presented as a demonstrated zero-click chain.
- The most detailed build/process evidence is from macOS. Do not transfer its privileges or mitigation behavior to iPhone without matched evidence.
- Apple lists fixes in iOS 26.7.2 and 27.2.