2026-10-27
IOStorageFamily
Tested on macOS 26.6.2 and macOS 27.0, fixed on macOS 27.2 and iOS 27.2.
macOS parses GUID Partition Tables (GPTs) in the kernel. A GPT partition name has 36 UTF-16 units (72 bytes). IOGUIDPartitionScheme passes its byte size, 72, to a converter that expects a count of UTF-16 units:
The call in instantiateMediaObject is:
ucs2_to_utf8(partition->ent_name,
sizeof(partition->ent_name), // 72 bytes, but interpreted as units
partitionName, sizeof(partitionName), UCS_LITTLE_ENDIAN);
With a full name and no NUL terminator, ucs2_to_utf8 can read up to 36 units beyond the field before converting them to UTF-8. The resulting IOMedia name is visible to unprivileged processes through IOKit. The read can also fault and panic the kernel.
poc_gpt_name.py puts an unterminated name in the last entry of a 512-byte GPT table. A vulnerable kernel may read beyond that table and expose adjacent kernel data in the published name.
python3 poc_gpt_name.py # writes /tmp/crasher.img
D=$(hdiutil attach -nomount -readonly /tmp/crasher.img | awk 'NR==1{print $1}')
ioreg -rc IOMedia | grep LEAK
hdiutil detach "$D"
A LEAK00... name longer than 36 characters confirms that data beyond the name field reached the public name. On a fixed kernel, this ASCII name is exactly 36 characters.
IOStorageFamily Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking.