Update README.md

Updated CVE entries and added details to the exploit chain.
This commit is contained in:
Joseph Goydish II
2026-01-11 15:09:28 -05:00
committed by GitHub
parent 1451559c2d
commit 393d0b38e8

View File

@@ -1,14 +1,15 @@
# Glass Cage: Zero-Click PNG Exploit Chain for iOS 18.2.1
**CVE-2025-24201** WebKit Remote Code Execution
**CVE-2025-24085** Core Media Privilege Escalation
**Reported to Apple:** December 18, 2024
- **CVE-2025-43300:** O.o.B Wrrite in ImageIO
- **CVE-2025-24201:** WebKit Remote Code Execution
- **CVE-2025-24085:** Core Media Privilege Escalation
**Patched:** Jan-March 2025
**Tested On:** iPhone 14 Pro Max (iOS 18.2.1)
[VirusTotal Analysis (Verified Hash)
](https://www.virustotal.com/gui/file/f1af3b4fd9f3f08253af21e4df4ea6bb35a135df0805d176238f26de80e8d167)
---
## Summary
@@ -29,19 +30,17 @@ https://ia600508.us.archive.org/8/items/cve-2025-24085-24201/cve%202025-24085%3B
1. **Malicious PNG Creation**
- Embedded HEIF payloads with malformed EXIF fields
- Triggers heap corruption in `ATXEncoder`
- Triggers heap corruption in `ATXEncoder` (CVE-2025-43300)
2. **Silent Trigger via iMessage**
- File auto-processed by `MessagesBlastDoorService` (CVE-2025-43300)
- File auto-processed by `MessagesBlastDoorService`
- RCE achieved through WebKit (CVE-2025-24201)
3. **Sandbox Escape**
- WebKit bypasses resource isolation to access private assets
4. **Privilege Escalation**
- Core Media flaw (CVE-2025-24085) enables kernel access
- Exploits `mediaplaybackd`, `codecctl`, and `IOHIDInterface`
- Core Media flaw enables kernel access
- Exploits `mediaplaybackd`, `codecctl`, and `IOHIDInterface` (CVE-2025-24085)
5. **Persistence and Bricking**
- Injects rogue daemons via `launchd`
- Hijacks network through `wifid`