usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple A12/A12X/A12Z/A13 and S4/S5 Chips Bypassing Secure Boot
usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple (TL-2026-0860), also tracked as usbliter8, is a critical-severity software vulnerability, first published 2026-06-18. It has no confirmed attribution, affects Apple A12 Bionic devices (iPhone XS, XS Max, XR; iPad Air 3rd gen, maps to 17 MITRE ATT&CK techniques (T1052.001, T1068, T1091), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0860
- Threat ID
- TL-2026-0860
- Also known as
- usbliter8
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-18
- Last reviewed
- 2026-06-18
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, defense, technology, telecommunications, financial, media, civil society
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple
Malware and tooling: checkm8 / checkra1n (prior-art BootROM USB DFU exploit tooling), usbliter8 (Paradigm Shift proof-of-concept)
usbliter8 is an unpatchable BootROM (SecureROM) exploit disclosed by Paradigm Shift that abuses a pointer-arithmetic buffer underflow in the Synopsys DWC2 USB controller's Setup-packet DMA handling on Apple A12/A12X/A12Z/A13 and S4/S5 silicon. Triggered over USB while a device is in DFU, it yields EL1 code execution and lets an attacker boot unsigned iBoot, nullifying Apple's Secure Boot chain. Because the flaw resides in immutable BootROM, no software patch is possible; the only mitigation is migrating to A14 or later hardware.
How usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple works
usbliter8 is a coordinated-disclosure BootROM vulnerability published on 2026-06-18 by the security research firm Paradigm Shift, accompanied by a working public proof-of-concept. It is the first publicly demonstrated BootROM-class compromise of Apple silicon since checkm8 (CVE-2019-8900, 2019, A5–A11), extending unpatchable physical-access compromise to the A12 and A13 generations.
Root cause: The Synopsys DesignWare DWC2 USB OTG controller used in Apple SecureROM stores up to three Setup packets in memory before resetting the DMA base address. The controller increments the DOEPDMA endpoint DMA pointer by the size of data written, but the reset operation unconditionally decrements DOEPDMA by a fixed 24 bytes. This increment/decrement mismatch produces a controlled buffer underflow primitive in 12-byte steps, enabling attacker-controlled writes to memory regions outside the intended USB I/O buffer. An attacker drives the primitive by sending a crafted sequence of unusually small USB Setup packets to a device in DFU mode, exploiting the USB DART bypass mode present in A12/A13 SecureROM.
Exploitation differs by chip family. On A12/A12X/A12Z and the S4/S5 watch SoCs, the attacker corrupts a saved Link Register on the heap stack to gain control during a scheduler context switch, then uses a compact ROP chain to redirect DMA writes into the boot trampoline. On A13, Pointer Authentication (PAC) raises the bar: researchers chained DART heap-metadata corruption with gadget-based function-pointer dereferencing, abusing an IB-key-only PAC configuration oversight to forge a usable control-flow transfer. A11 (iPhone X) is not affected because it performs a manual pointer reset after each packet; A14 and later are not affected due to a corrected DART configuration and memory protection.
Impact: usbliter8 grants EL1 code execution in the boot chain and permits booting of raw, unsigned iBoot images, bypassing all signature verification and effectively defeating Secure Boot. Observable side effects mirror the checkm8 family: the device is left in a 'pwned DFU' state and a 'PWNED' marker is injected into the USB serial-number string. The exploit does not directly compromise the Secure Enclave Processor, but Paradigm Shift notes that a BootROM foothold opens broader avenues for subsequent SEP attack. Exploitation requires physical possession of the device and a USB connection; it is not remotely exploitable and produces no network indicators. Because SecureROM is mask-ROM baked into the SoC at manufacture, affected devices remain vulnerable for their entire service life — there is no firmware or OS update that can remediate the flaw.
MITRE ATT&CK techniques used in TL-2026-0860
Exfiltration
T1052.001 Exfiltration over USB
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
T1091 Replication Through Removable Media; T1200 Hardware Additions
Execution
T1203 Exploitation for Client Execution
Defense Evasion
T1211 Exploitation for Stealth; T1542 Pre-OS Boot
Impact
T1490 Inhibit System Recovery; T1495 Firmware Corruption
Persistence
T1542.001 System Firmware; T1542.002 Component Firmware; T1542.003 Bootkit
defense-impairment
T1553 Subvert Trust Controls; T1553.006 Code Signing Policy Modification; T1601.002 Downgrade System Image; T1685 Disable or Modify Tools
Resource Development
Affected products and versions in usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple
- Apple — A12 Bionic devices (iPhone XS, XS Max, XR; iPad Air 3rd gen; iPad mini 5th gen; Apple TV 4K 2nd gen)
Vulnerable versions: A12 SecureROM - Apple — A12X / A12Z devices (iPad Pro 11-inch and 12.9-inch, 2018-2020)
Vulnerable versions: A12X SecureROM; A12Z SecureROM - Apple — A13 Bionic devices (iPhone 11, 11 Pro, 11 Pro Max; iPhone SE 2nd gen)
Vulnerable versions: A13 SecureROM (IB-key-only PAC configuration) - Apple — S4 / S5 SiP (Apple Watch Series 4 and Series 5)
Vulnerable versions: S4 SecureROM; S5 SecureROM - Apple — A14 and later silicon
Fixed in: A14 and later (corrected DART configuration / memory protection) - Synopsys — DesignWare DWC2 USB OTG controller (as integrated into Apple SecureROM)
Vulnerable versions: DWC2 core as configured in A12/A12X/A12Z/A13/S4/S5 SecureROM
Remediation for usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple
Immediate actions
- Treat A12/A12X/A12Z, A13, and S4/S5 devices as physically untrusted: enforce strong device passcodes (data-at-rest encryption keys remain protected by the Secure Enclave even after BootROM compromise) and enable USB Restricted Mode / Lockdown Mode where supported.
- Maintain strict physical custody of high-risk devices; assume any unattended period with USB/DFU access is a potential compromise window.
- Disable or block USB DFU/recovery access on managed endpoints via MDM where the platform allows, and physically restrict USB-C/Lightning connectivity for sensitive populations.
Workarounds
- No software patch is possible — the flaw is in immutable BootROM. Compensating controls only: physical security, passcode strength, USB Restricted Mode, and Lockdown Mode.
- Rely on Secure Enclave-backed data protection: usbliter8 does not directly defeat the SEP, so a strong passcode still protects encrypted user data even on a pwned device.
Longer-term hardening
- Migrate sensitive workloads off A12/A13-class hardware to A14 or later devices, which are not vulnerable due to corrected DART configuration.
- Adopt a hardware-refresh policy that retires BootROM-vulnerable Apple silicon from sensitive use as it ages.
- For Apple Watch Series 4/5 (S4/S5), rotate to S6+ models for users handling sensitive credentials or attestation.
Weaknesses (CWE) in usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple
CWE-124, CWE-787, CWE-823
Timeline of usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple
- Apple A12 Bionic ships (iPhone XS/XS Max/XR), introducing the SecureROM with the vulnerable DWC2 DMA Setup-packet handling later abused by usbliter8.
- Apple A12X ships in the 2018 iPad Pro; its SecureROM shares the vulnerable DWC2 DMA Setup-packet handling abused by usbliter8.
- Apple A13 Bionic ships (iPhone 11 series) with PAC; usbliter8's A13 chain later defeats an IB-key-only PAC configuration oversight.
- checkm8 (CVE-2019-8900) publicly released, demonstrating the unpatchable USB DFU BootROM exploit class on Apple A5-A11 silicon.
- Apple A12Z ships in the 2020 iPad Pro, extending the vulnerable A12-class SecureROM to the most recent affected iPad hardware.
- Apple A14 ships (iPhone 12); A14 and later correctly configure DART/memory protection at the BootROM level and are not vulnerable to usbliter8.
- Cyber Security News and MacRumors report on usbliter8, confirming the affected device list and the unpatchable, hardware-bound nature of the flaw.
- Public proof-of-concept made available in Paradigm Shift's research repository, enabling unsigned iBoot boot on affected A12/A12X/A12Z/A13 and S4/S5 devices.
- Paradigm Shift publicly discloses the usbliter8 BootROM vulnerability and a working proof-of-concept after coordinated disclosure with Apple Product Security.
Sources cited for usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple
- New iPhone BootROM Vulnerability (usbliter8) Lets Attackers Bypass Secure Boot
- Apple's A12 and A13 Chips Facing New Unpatchable Exploit
- checkm8 Exploit (CVE-2019-8900) — The Apple Wiki (prior-art BootROM USB DFU exploit class)
- Technical analysis of the checkm8 exploit — Habr / Digital Security (USB DFU stack mechanics precedent)
- A comprehensive write-up of the checkm8 BootROM exploit — Alfie CG
- Bootrom / SecureROM — The Apple Wiki
- The Unpatchable Flaw: A Deep Dive into Apple's DFU Mode and the Checkm8 Exploit — Medium
Threats related to usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple
- usbliter8 — Unpatchable SecureROM Boot-Chain Code Execution on Apple A12/A13 (and S4/S5) SoCs via DWC2 USB DMA Underflow
- usbliter8 — checkm8-style unpatchable BootROM/SecureROM exploit for Apple A12/A13 (and S4/S5) devices
- Forgotten UEFI Shims Undermine Secure Boot (CVE-2026-8863, CVE-2026-10797)
- Dell BIOS Flaw (CVE-2026-40639 / DSA-2026-197) Lets Attackers Recover Admin Passwords From SPI Flash
- 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure Boot Bypass (CVE-2026-8863, CVE-2026-10797)
- "Download More RAM" Attack Bypasses Windows VBS and Disables Defender Through Memory Aliasing (CVE-2026-23670)
Detection coverage for TL-2026-0860
As of 2026-06-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0860 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.