Medium Severity
Published: Nov 9, 2026
iOS27-Research-Exploits
<p align="center">
<img src="docs/icon.png" alt="Bench27" width="160">
</p>
<h1 align="center">Bench27</h1>
<p align="center">
iOS 27 security research bench · iOS 27.0.1 (24A446) · iPhone 18,1 · A19 Pro
</p>
> **Everything in this repository is provided strictly for educational and
> familiarization purposes.** It documents a measurement bench and the results it
> produced on the author's own device. It is not a product, not a tool for
> attacking anyone, and not a claim that the systems described are compromised.
> Use it to learn how the interfaces behave, on hardware you own, with the
> permission of everyone involved.
Security research notes and a reproduction bench for iOS 27, run on a real
device from a sandboxed app with **no entitlements**.
| | |
|---|---|
| Device | iPhone 17 Pro · iPhone18,1 · A19 Pro (T8150) |
| OS | iOS 27.0.1 (24A446), arm64e |
| Compared against | iOS 27.2 (24B119), statically |
| Bench | [Bench27](app/) — 81 tests, grouped by article
| Verdicts | [STATUS.md](STATUS.md) — one page, one vocabulary |
| Bench | 70 probes across 10 articles |, one per question, with timestamped logs on device |
---
## Findings
| # | Direction | Result | Class |
|---|---|---|---|
| 01 | [IOSurface size validation](research/01-iosurface-size-validation/) | a 4 GiB header region is accepted for a 64 KiB surface | validation defect |
| 02 | [Metal GPU VA cross-allocation access](research/02-metal-gpu-va/) | read and write of other GPU pages of the same context | observed behaviour |
| 03 | [mediaplaybackd / FigXPC](research/03-mediaplaybackd-xpc/) | NULL dereference through `sandboxserver` | denial of service |
| 04 | [AppleAVE2](research/04-appleave2/) | write to a fixed address; the OOB candidate was not reached | denial of service |
| 05 | [ANE reachability](research/05-ane-reachability/) | not reachable from the sandbox | negative |
| 06 | [AppleM2ScalerCSCDriver](research/06-scaler/) | full ABI map and a working transform; the property path is