# 0xblackash/cve-2026-43786 architecture

> Architecture diagram of the GitHub repository 0xblackash/cve-2026-43786, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/0xblackash/cve-2026-43786
- Repository: https://github.com/0xblackash/cve-2026-43786

## Overview

This is a single-binary macOS privilege-escalation PoC, not a general-purpose application. Its documented workflow begins with a low-privileged local user and aims to cross an entitlement-enforcement boundary to privileged operations. The sampled C shows payload construction, MIG setup, a threaded LDAP-like server with an in-memory directory, and Mach-message helpers. The README describes the security-boundary outcome, but does not document how these implementation pieces connect end to end; those links are omitted rather than inferred.

Main entry points: [`CVE-2026-43786.c`](https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c) (PoC Main)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["PoC Entry"]
  node_main["PoC Main<br/>[CVE-2026-43786.c]"]
  node_payload["Payload Builder<br/>[CVE-2026-43786.c]"]
end

subgraph group_ldap["LDAP Server"]
  node_ldapaccept["LDAP Acceptor<br/>[CVE-2026-43786.c]"]
  node_conn["Connection Worker<br/>[CVE-2026-43786.c]"]
  node_directory[("In-Memory Directory<br/>[CVE-2026-43786.c]")]
  node_search["Search Handler<br/>[CVE-2026-43786.c]"]
end

subgraph group_mach["Mach IPC"]
  node_migsetup["MIG Setup<br/>[CVE-2026-43786.c]"]
  node_sendverb["Mach Verb Sender<br/>[CVE-2026-43786.c]"]
  node_transact["Mach Transaction<br/>[CVE-2026-43786.c]"]
end

subgraph group_security["Privilege Boundary"]
  node_validation["Entitlement Check"]
  node_boundary{{"Security Boundary"}}
  node_root(("Root Privileges"))
end

node_user(("Local User"))
node_machservice["macOS Mach Service"]

node_user -->|"runs locally"| node_main
node_main -->|"builds payload"| node_payload
node_main -->|"sets up MIG"| node_migsetup
node_ldapaccept -->|"spawns workers"| node_conn
node_search -->|"searches entries"| node_directory
node_sendverb -->|"calls"| node_transact
node_main -->|"triggers check"| node_validation
node_validation -->|"crosses boundary"| node_boundary
node_boundary -->|"may reach"| node_root

click node_main "https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c"
click node_payload "https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c"
click node_migsetup "https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c"
click node_ldapaccept "https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c"
click node_conn "https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c"
click node_directory "https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c"
click node_search "https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c"
click node_sendverb "https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c"
click node_transact "https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_payload,node_user toneBlue
class node_ldapaccept,node_conn,node_directory,node_search toneAmber
class node_migsetup,node_sendverb,node_transact toneMint
class node_validation,node_boundary,node_root toneRose
class node_machservice toneIndigo
```

## Components

### PoC Entry

- [PoC Main](https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c): `CVE-2026-43786.c`
- [Payload Builder](https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c): `CVE-2026-43786.c`

### LDAP Server

- [LDAP Acceptor](https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c): `CVE-2026-43786.c`
- [Connection Worker](https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c): `CVE-2026-43786.c`
- [In-Memory Directory](https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c): `CVE-2026-43786.c`
- [Search Handler](https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c): `CVE-2026-43786.c`

### Mach IPC

- [MIG Setup](https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c): `CVE-2026-43786.c`
- [Mach Verb Sender](https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c): `CVE-2026-43786.c`
- [Mach Transaction](https://github.com/0xblackash/cve-2026-43786/blob/main/CVE-2026-43786.c): `CVE-2026-43786.c`

### Privilege Boundary

- **Entitlement Check**
- **Security Boundary**
- **Root Privileges**

### Other components

- **Local User**
- **macOS Mach Service**

## Connections

- Local User → PoC Main: runs locally (evidence: `README.md`)
- PoC Main → Payload Builder: builds payload (evidence: `CVE-2026-43786.c`)
- PoC Main → MIG Setup: sets up MIG (evidence: `CVE-2026-43786.c`)
- LDAP Acceptor → Connection Worker: spawns workers (evidence: `CVE-2026-43786.c`)
- Search Handler → In-Memory Directory: searches entries (evidence: `CVE-2026-43786.c`)
- Mach Verb Sender → Mach Transaction: calls (evidence: `CVE-2026-43786.c`)
- PoC Main → Entitlement Check: triggers check (evidence: `README.md`)
- Entitlement Check → Security Boundary: crosses boundary (evidence: `README.md`)
- Security Boundary → Root Privileges: may reach (evidence: `README.md`)