RawCamera · Phase One
A Phase One decoder trusts a file-supplied correction length. A one-tag control and measured fault make the new Project Zero disclosure particularly useful to study.
- Capability
- 16-bit read-modify-write overflow
- Device & build
- Published runtime evidence: macOS 26.6.2 (25G83), arm64e
- Primary artifact
- Report + PoC
- Published
- Reviewed
Observed
- One segment of a flat-field correction loop lacks the row-width bound enforced on the neighboring segment.
- The file influences both the loop extent and a per-row correction value. The effect is a constrained 16-bit read-modify-write that can extend beyond the decoded pixel allocation.
- The report supplies a crashing IIQ image and a control differing in a single tag, alongside loop measurements and an allocation-boundary fault.
Assessment
The control isolates the missing bound more clearly than a standalone crash. This is credible public memory-corruption research. Freely chosen bytes, an arbitrary destination, and completed code execution are not established by the published reproduction.
Limits
- Apple lists the issue as fixed in iOS 26.7 and the iOS 27 branch.
- Newly public technical detail does not make this a new unpatched iOS 27 entry point.
- The supplied exact-build runtime evidence is on macOS; no independent iPhone reproduction was performed here.