# usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple A12/A12X/A12Z/A13 and S4/S5 Chips Bypassing Secure Boot

> usbliter8 is an unpatchable BootROM (SecureROM) exploit disclosed by Paradigm Shift that abuses a pointer-arithmetic buffer underflow in the Synopsys DWC2 USB controller's Setup-packet DMA handling on Apple A12/A12X/A12Z/A13 and S4/S5 silicon. Triggered over USB while a device is in DFU, it yields EL1 code execution and lets an attacker boot unsigned iBoot, nullifying Apple's Secure Boot chain. Because the flaw resides in immutable BootROM, no software patch is possible; the only mitigation is migrating to A14 or later hardware.

- **Published:** 2026-06-18T00:00:00Z
- **Last reviewed:** 2026-06-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0860
- **ID:** TL-2026-0860
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2019-8900

## Description

usbliter8 is a coordinated-disclosure BootROM vulnerability published on 2026-06-18 by the security research firm Paradigm Shift, accompanied by a working public proof-of-concept. It is the first publicly demonstrated BootROM-class compromise of Apple silicon since checkm8 (CVE-2019-8900, 2019, A5–A11), extending unpatchable physical-access compromise to the A12 and A13 generations.

Root cause: The Synopsys DesignWare DWC2 USB OTG controller used in Apple SecureROM stores up to three Setup packets in memory before resetting the DMA base address. The controller increments the DOEPDMA endpoint DMA pointer by the size of data written, but the reset operation unconditionally decrements DOEPDMA by a fixed 24 bytes. This increment/decrement mismatch produces a controlled buffer underflow primitive in 12-byte steps, enabling attacker-controlled writes to memory regions outside the intended USB I/O buffer. An attacker drives the primitive by sending a crafted sequence of unusually small USB Setup packets to a device in DFU mode, exploiting the USB DART bypass mode present in A12/A13 SecureROM.

Exploitation differs by chip family. On A12/A12X/A12Z and the S4/S5 watch SoCs, the attacker corrupts a saved Link Register on the heap stack to gain control during a scheduler context switch, then uses a compact ROP chain to redirect DMA writes into the boot trampoline. On A13, Pointer Authentication (PAC) raises the bar: researchers chained DART heap-metadata corruption with gadget-based function-pointer dereferencing, abusing an IB-key-only PAC configuration oversight to forge a usable control-flow transfer. A11 (iPhone X) is not affected because it performs a manual pointer reset after each packet; A14 and later are not affected due to a corrected DART configuration and memory protection.

Impact: usbliter8 grants EL1 code execution in the boot chain and permits booting of raw, unsigned iBoot images, bypassing all signature verification and effectively defeating Secure Boot. Observable side effects mirror the checkm8 family: the device is left in a 'pwned DFU' state and a 'PWNED' marker is injected into the USB serial-number string. The exploit does not directly compromise the Secure Enclave Processor, but Paradigm Shift notes that a BootROM foothold opens broader avenues for subsequent SEP attack. Exploitation requires physical possession of the device and a USB connection; it is not remotely exploitable and produces no network indicators. Because SecureROM is mask-ROM baked into the SoC at manufacture, affected devices remain vulnerable for their entire service life — there is no firmware or OS update that can remediate the flaw.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1200 Hardware Additions
- T1091 Replication Through Removable Media
- T1203 Exploitation for Client Execution
- T1542.001 System Firmware
- T1542.003 Bootkit
- T1068 Exploitation for Privilege Escalation
- T1542 Pre-OS Boot
- T1211 Exploitation for Stealth
- T1553 Subvert Trust Controls
- T1553.006 Code Signing Policy Modification
- T1685 Disable or Modify Tools
- T1601.002 Downgrade System Image
- T1542.002 Component Firmware
- T1490 Inhibit System Recovery
- T1052.001 Exfiltration over USB
- T1495 Firmware Corruption

## Sources

- [New iPhone BootROM Vulnerability (usbliter8) Lets Attackers Bypass Secure Boot](https://cybersecuritynews.com/iphone-bootrom-vulnerability/)
- [Apple's A12 and A13 Chips Facing New Unpatchable Exploit](https://www.macrumors.com/2026/06/18/a12-and-a13-chips-facing-exploit/)
- [checkm8 Exploit (CVE-2019-8900) — The Apple Wiki (prior-art BootROM USB DFU exploit class)](https://theapplewiki.com/wiki/Checkm8_Exploit)
- [Technical analysis of the checkm8 exploit — Habr / Digital Security (USB DFU stack mechanics precedent)](https://habr.com/en/companies/dsec/articles/472762/)
- [A comprehensive write-up of the checkm8 BootROM exploit — Alfie CG](https://alfiecg.uk/2023/07/21/A-comprehensive-write-up-of-the-checkm8-BootROM-exploit.html)
- [Bootrom / SecureROM — The Apple Wiki](https://theapplewiki.com/wiki/Bootrom)
- [The Unpatchable Flaw: A Deep Dive into Apple's DFU Mode and the Checkm8 Exploit — Medium](https://medium.com/@saadanashraf86/the-unpatchable-flaw-a-deep-dive-into-apples-dfu-mode-and-the-checkm8-exploit-0d3dae2a2075)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0860