Medium Severity
Published: Nov 8, 2026
iOS27-Research-Exploits
# iOS 27.0.1 — Research Exploits
Security research notes and a reproduction bench for iOS 27, run on a real
device from a sandboxed app with **no entitlements**.
| | |
|---|---|
| Device | iPhone 17 Pro · iPhone18,1 · A19 Pro (T8150) |
| OS | iOS 27.0.1 (24A446), arm64e |
| Compared against | iOS 27.2 (24B119), statically |
| Bench | [Bench27](app/) — FigXPC, Metal, IOKit probes in one app |
---
## Findings
| # | Direction | Result | Class |
|---|---|---|---|
| 01 | [IOSurface size validation](research/01-iosurface-size-validation/) | a 4 GiB header region is accepted for a 64 KiB surface | validation defect |
| 02 | [Metal GPU VA cross-allocation access](research/02-metal-gpu-va/) | read and write of other GPU pages of the same context | observed behaviour |
| 03 | [mediaplaybackd / FigXPC](research/03-mediaplaybackd-xpc/) | NULL dereference through `sandboxserver` | denial of service |
| 04 | [AppleAVE2](research/04-appleave2/) | write to a fixed address; the OOB candidate was not reached | denial of service |
| 05 | [ANE reachability](research/05-ane-reachability/) | not reachable from the sandbox | negative |
**No kernel R/W was obtained.** None of the directions crosses a process
boundary.
---
## Layout
```
app/ Bench27: Swift + C, built by GitHub Actions
Sources/ all probes live in XPCProbe.swift
Resources/ sample media
research/ one folder per direction, each with a README and a report
01-iosurface-size-validation/
02-metal-gpu-va/
03-mediaplaybackd-xpc/
04-appleave2/
05-ane-reachability/
archive/ early material, kept for history
tools/ report sync helper
```
---
## Directions in brief
### 01 · IOSurface
A surface whose declared header region is `0x100000000` (4 GiB) is accepted
while the real allocation is 64 KiB. The cause is 32-bit arithmetic on the
compressed-plane geometry. No expansion of accessible memory was observed.
### 02 · Metal GPU