Calif throws down the gauntlet: beat Apple's MIE with two vulnerabilities

Calif, the company that back in May demonstrated the first public bypass of Apple's MIE (Memory Integrity Enforcement) mechanism on macOS 26.4.1, has now published details of the two vulnerabilities that underpinned its exploit. The technical specifics were held back until the fixes shipped in macOS 26.6; the authors promise to present a full breakdown of the chain at the Black Hat USA conference on August 5. Since March the team has reported 38 vulnerabilities to Apple — and the count keeps climbing.

Two bugs in open-source components

Both vulnerabilities sit in subsystems whose source code Apple publishes openly. In macOS, both SMB and WebDAV are built on a “split” design: the file system lives in the kernel, while a helper agent in user space handles the session or the HTTP transport. In both cases the attack comes from a malicious server that the client connects to.

The first bug (CVE-2026-64704) is a type confusion in the handling of SMB2 create contexts. The client sends a “Resolve ID” context, storing on the stack a structure whose first field — the inode number — is effectively under the caller's control. When parsing the response, the code looks not at what was sent but at the four-byte context name in the server's reply. A malicious server responds with a lease context (RqLs), and the parser dutifully interprets the Resolve ID structure as an entirely different type — turning the controlled inode number into a pointer that is then dereferenced.

The second bug (CVE-2026-64699) is a disclosure of uninitialized memory in the WebDAV read path. When the program reads a not-yet-downloaded region of a file far ahead of the cache, the kernel requests the bytes directly. Here three individually harmless decisions coincided: a buffer of up to 16 MB is allocated without zeroing (the source, incidentally, sports a typo, 16 * 1024 * 1204), the agent treats any 2xx HTTP status as success — including an empty 206 response — and the kernel copies to the user exactly as many bytes as were requested, without checking how many actually arrived. As a result, whatever previously sat in those pages leaks out.

An invitation to compete

The combination of an infoleak and a type confusion yields read and write primitives in kernel memory and, potentially, code execution. But between these two bugs and root privileges lies a “mesh” of overlapping MIE defenses — at the hardware, hypervisor, kernel and user-space levels.

Calif deliberately makes the task artificial: not to find the easiest path to privilege escalation, but specifically to use these two vulnerabilities to overcome the kernel's memory-protection mechanisms and reach root on a modern macOS with MIE fully enabled. In the authors' view, exploiting the XNU kernel today is one of the hardest and most interesting targets for AI-assisted exploit development. For the team itself, the road from finding the bugs to a polished exploit took about five days. Humans, AIs and mixed teams are invited to take part; Calif will publish its own solution after its Black Hat talk.

Source: Lobsters