How 0xblackash/cve-2026-43786 works
This is a single-binary macOS privilege-escalation PoC, not a general-purpose application. Its documented workflow begins with a low-privileged local user and aims to cross an entitlement-enforcement boundary to privileged operations. The sampled C shows payload construction, MIG setup, a threaded LDAP-like server with an in-memory directory, and Mach-message helpers. The README describes the security-boundary outcome, but does not document how these implementation pieces connect end to end; those links are omitted rather than inferred.
Main entry points: CVE-2026-43786.c PoC Main
Components 14
PoC Entry
- PoC Main
CVE-2026-43786.c - Payload Builder
CVE-2026-43786.c
LDAP Server
- LDAP Acceptor
CVE-2026-43786.c - Connection Worker
CVE-2026-43786.c - In-Memory Directory
CVE-2026-43786.c - Search Handler
CVE-2026-43786.c
Mach IPC
- MIG Setup
CVE-2026-43786.c - Mach Verb Sender
CVE-2026-43786.c - Mach Transaction
CVE-2026-43786.c
Privilege Boundary
- Entitlement Check
- Security Boundary
- Root Privileges
Other components
- Local User
- macOS Mach Service
Connections 9
- Local User → PoC Main: runs locally
README.md - PoC Main → Payload Builder: builds payload
CVE-2026-43786.c - PoC Main → MIG Setup: sets up MIG
CVE-2026-43786.c - LDAP Acceptor → Connection Worker: spawns workers
CVE-2026-43786.c - Search Handler → In-Memory Directory: searches entries
CVE-2026-43786.c - Mach Verb Sender → Mach Transaction: calls
CVE-2026-43786.c - PoC Main → Entitlement Check: triggers check
README.md - Entitlement Check → Security Boundary: crosses boundary
README.md - Security Boundary → Root Privileges: may reach
README.md