Short Circuit LLCCYBERSECURITY & RESEARCH
Search
ORIGINAL RESEARCH / DISCLOSURES
This section is reserved for original vulnerability findings and coordinated disclosures by Short Circuit LLC, cleared for public release. Our coverage of other teams’ research is published in Articles ↗.
Our own technical investigations, with methods, evidence and limitations.
Our disclosed vulnerabilities, affected products and available fixes.
Reports published when disclosure is cleared, with accurate sources and credit.
My iPhone test app had never been granted music-library access. A CoreMedia service returned the complete local music file anyway. The byte comparison, unchanged permission state and protected-file controls explain exactly where the boundary failed.
A video’s metadata corrupted working memory in a system display service. I traced the crash to a count the parser had already rejected—and to the later count its first overwrite damaged.
A nearby, unpaired peer crashed the Bluetooth service on my actively discoverable iPad. The device records showed the failure; the connection tests established the conditions under which I could reach it.
Apple’s Bluetooth code recognized an unsuitable channel, returned a failed result and crashed when its caller used it anyway. My report shows how working checks, reassuring logs and a real service failure can all coexist.
Verified private-key exports, a crash on a locked phone and kernel faults: the research behind my five September Apple CVE credits.