RawCamera · Canon sRAW
Project Zero’s report connects a signed geometry-check failure to a negative row step, with a crafted image and debugger evidence. The iOS 27 branch is already fixed.
- Capability
- Out-of-bounds buffer write
- Device & build
- Published runtime evidence: macOS 26.6.2 (25G83), arm64e
- Primary artifact
- Report + PoC
- Published
- Reviewed
Observed
- A malformed Canon sRAW image passes a signed arithmetic check. A separate unchecked component count produces a negative destination-row step.
- The decoder then writes file-derived chroma samples backward below the pixel allocation. The report ties debugger observations and the crash address to the affected store.
- The report supplies a crafted CR2 file and identifies the unmodified input as a working control.
Assessment
The published effect is a linear out-of-bounds write with file-influenced contents and an allocation-relative destination. The report assesses code-execution risk, but its published runtime result is a corruption reproduction, not a complete execution chain.
Limits
- Project Zero reports this fixed in macOS/iOS 27. Apple also lists the older-branch fix in iOS 26.7.2.
- This does not supply an entry point for iOS 27.0.1 or 27.2.
- The exact public reproduction is on a Mac. An equivalent iPhone delivery path and exploit chain have not been established by this review.