Short Circuit LLCCYBERSECURITY & RESEARCH
Search
ORIGINAL RESEARCH / DISCLOSURES
This section is reserved for original vulnerability findings and coordinated disclosures by Short Circuit LLC, cleared for public release. Our coverage of other teams’ research is published in Articles ↗.
Our own technical investigations, with methods, evidence and limitations.
Our disclosed vulnerabilities, affected products and available fixes.
Reports published when disclosure is cleared, with accurate sources and credit.
Apple credits Chris Bailey of Short Circuit in seven new CVEs, including two Bluetooth entries naming him alone. Here is the work behind the numbers, with a separate article on each finding.
After a Mac mounted a malicious WebDAV share, its directory reply could push Apple’s parser past a memory boundary. My research compared live service failures with a separate model of the overwrite.
A local process outside the App Sandbox received private-key material from my Mac’s system keychain. The helper could refuse unauthorized access, but its export operation never called the check.
A crafted animated image crashed the message-preview service on my locked test iPhone. I traced it to disagreement over frame metadata and a numerical check that accepted impossible geometry.
A sandboxed app could reach a missing kernel array check on my test iPhone. The neighboring operation checked the boundary correctly. My evidence showed kernel faults and controlled state—not data returned to the app—and the tested Mac blocked the path.
My app changed live objects inside a CoreMedia service. The control produced no event confirmations; enabling the write produced four. A separate crash demonstrated control of a working value, with different limits.
Spotlight narrowed my app’s search correctly, then widened it with unchecked additions. Establishing the disclosure also meant fixing a weak test baseline and proving which app’s records were actually coming back.
The Shortcuts helper could refuse my app and still return private text through a different operation. My research found the missing caller check in the step that prepared choices for an action, before the action ever ran.
My app failed Screen Time’s caller check and still received recorded Safari URLs. The check ran inside the app; the service releasing the records did not enforce it. Here is the comparison that established the bug.