diff --git a/README.md b/README.md index 139c3ba..ec32e6d 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,15 @@ # Glass Cage: Zero-Click PNG Exploit Chain for iOS 18.2.1 -**CVE-2025-24201** – WebKit Remote Code Execution -**CVE-2025-24085** – Core Media Privilege Escalation - -**Reported to Apple:** December 18, 2024 +- **CVE-2025-43300:** O.o.B Wrrite in ImageIO +- **CVE-2025-24201:** WebKit Remote Code Execution +- **CVE-2025-24085:** Core Media Privilege Escalation **Patched:** Jan-March 2025 - **Tested On:** iPhone 14 Pro Max (iOS 18.2.1) +[VirusTotal Analysis (Verified Hash) +](https://www.virustotal.com/gui/file/f1af3b4fd9f3f08253af21e4df4ea6bb35a135df0805d176238f26de80e8d167) + --- ## Summary @@ -29,19 +30,17 @@ https://ia600508.us.archive.org/8/items/cve-2025-24085-24201/cve%202025-24085%3B 1. **Malicious PNG Creation** - Embedded HEIF payloads with malformed EXIF fields - - Triggers heap corruption in `ATXEncoder` - + - Triggers heap corruption in `ATXEncoder` (CVE-2025-43300) 2. **Silent Trigger via iMessage** - - File auto-processed by `MessagesBlastDoorService` (CVE-2025-43300) + - File auto-processed by `MessagesBlastDoorService` - RCE achieved through WebKit (CVE-2025-24201) 3. **Sandbox Escape** - WebKit bypasses resource isolation to access private assets 4. **Privilege Escalation** - - Core Media flaw (CVE-2025-24085) enables kernel access - - Exploits `mediaplaybackd`, `codecctl`, and `IOHIDInterface` - + - Core Media flaw enables kernel access + - Exploits `mediaplaybackd`, `codecctl`, and `IOHIDInterface` (CVE-2025-24085) 5. **Persistence and Bricking** - Injects rogue daemons via `launchd` - Hijacks network through `wifid`