usbliter8 — Unpatchable SecureROM Boot-Chain Code Execution on Apple A12/A13 (and S4/S5) SoCs via DWC2 USB DMA Underflow

usbliter8 — Unpatchable SecureROM Boot-Chain Code Execution (TL-2026-0876), also tracked as usbliter8, is a high-severity software vulnerability, first published 2026-06-19. It has no confirmed attribution, affects Apple A12 Bionic SoC (SecureROM / boot ROM), maps to 13 MITRE ATT&CK techniques (T1005, T1014, T1068), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-0876

Threat ID
TL-2026-0876
Also known as
usbliter8, PWND:[usbliter8]
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-19
Last reviewed
2026-06-19
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, defense, financial, technology, media, civil-society, consumer
Target regions
Global
Detection rules
9
Indicators of compromise
16

Malware and tooling in usbliter8 — Unpatchable SecureROM Boot-Chain Code Execution

Malware and tooling: RP2350-based USB microcontroller board, usbliter8

Paradigm Shift disclosed 'usbliter8', a working SecureROM (boot ROM) exploit achieving arbitrary code execution on Apple A12/A13 and S4/S5 devices. A buffer underflow in the Synopsys DWC2 USB controller's DMA Setup-packet handling, combined with the USB DART (IOMMU) running in bypass mode inside SecureROM, lets a physically-present attacker in DFU mode overwrite SRAM and take program-counter control. Like 2019's checkm8, the flaw is burned into silicon and cannot be fixed by software. A public PoC exists; no in-the-wild exploitation has been reported.

How usbliter8 — Unpatchable SecureROM Boot-Chain Code Execution works

On 18-19 June 2026 the research group Paradigm Shift published 'usbliter8', the first public Apple boot ROM (SecureROM) code-execution exploit since checkm8 (2019), targeting the A12 and A13 application processors and the S4/S5 watch SoCs. The vulnerability is a hardware-level flaw in the Synopsys DesignWare USB 2.0 (DWC2) controller used by Apple's SecureROM USB stack. The controller stores incoming USB Setup packets via DMA, buffers up to three, then resets its write pointer on the fourth by decrementing it by a fixed 24 bytes. It also accepts smaller-than-standard Setup packets while only incrementing the write pointer by the number of bytes actually written. That mismatch accumulates into a repeatable buffer underflow that steps the DMA write pointer backwards through memory 12 bytes at a time.

What makes the underflow exploitable on A12/A13 is Apple's configuration of the USB DART (Device Address Resolution Table — the SoC's IOMMU) inside SecureROM: it runs in bypass mode, so the underflowing DMA pointer can reach and overwrite arbitrary SRAM. A11 is not affected because its SecureROM USB driver manually resets the DMA address after every packet, so the mismatch never accumulates; A14 and later correctly program DART in SecureROM, rendering the bug unexploitable on newer silicon.

On A12 the DMA buffer sits adjacent to the USB task's stack, so the underflow directly overwrites a saved link register (LR), granting program-counter control on the next context switch. A compact ROP chain then reprograms the DMA destination to target the boot trampoline (a region not writable from EL0/EL1 but reachable via DMA), injects attacker-controlled shellcode, and redirects execution to gain EL1 privileges. A13 adds Pointer Authentication (PAC), which blocks direct LR corruption; the researchers bypass it in stages — corrupting DART-related heap structures to create limited write primitives, overwriting the SecureROM panic depth counter so the chip loops on errors instead of rebooting (keeping the device alive through repeated exploitation attempts), and overwriting USB interrupt-handler pointers to reach execution. The attack hardware is an RP2350-based USB microcontroller board acting as the malicious USB host.

Post-exploitation, the attacker can inject custom USB request handlers, mark the device with a 'PWND:[usbliter8]' serial string within the active DFU session, demote the device from production mode, and boot unsigned iBoot images — stepping outside Apple's chain of trust before iOS loads. The attack requires physical possession, a USB connection, DFU mode, and a USB microcontroller board, and completes in under two seconds. It is a tethered boot-level compromise (it must be re-run on each boot); it does NOT directly compromise the Secure Enclave (SEP), which remains isolated, so user-data-at-rest protections and passcode-derived keys are not directly defeated, though it expands the attack surface against other parts of the platform. Paradigm Shift coordinated disclosure with Apple Product Security before publishing; as of 19 June 2026 no CVE, CVSS score, or in-the-wild exploitation has been assigned or reported.

MITRE ATT&CK techniques used in TL-2026-0876

Collection

T1005 Data from Local System

Defense Evasion

T1014 Rootkit; T1211 Exploitation for Stealth; T1542 Pre-OS Boot

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1091 Replication Through Removable Media; T1200 Hardware Additions

Execution

T1203 Exploitation for Client Execution

Impact

T1490 Inhibit System Recovery; T1495 Firmware Corruption

Persistence

T1542 Pre-OS Boot

defense-impairment

T1553 Subvert Trust Controls; T1685 Disable or Modify Tools

Resource Development

T1587 Develop Capabilities

Affected products and versions in usbliter8 — Unpatchable SecureROM Boot-Chain Code Execution

  • Apple — A12 Bionic SoC (SecureROM / boot ROM)
    Vulnerable versions: A12; A12X (theoretical, not implemented); A12Z (theoretical, not implemented)
  • Apple — A13 Bionic SoC (SecureROM / boot ROM)
    Vulnerable versions: A13
  • Apple — S4 / S5 Apple Watch SoC (SecureROM)
    Vulnerable versions: S4; S5
  • Apple — iOS/iPadOS/watchOS devices on A12/A13/S4/S5
    Vulnerable versions: iPhone XS; iPhone XS Max; iPhone XR; iPhone 11; iPhone 11 Pro; iPhone 11 Pro Max; iPhone SE (2nd gen); iPad Air (3rd gen); iPad mini (5th gen); iPad (8th gen)
    Fixed in: A14 and later silicon (DART correctly programmed in SecureROM)
  • Synopsys — DesignWare USB 2.0 (DWC2) controller IP (as integrated in Apple SecureROM USB stack)
    Vulnerable versions: as configured on A12/A13/S4/S5 with DART in bypass mode

Remediation for usbliter8 — Unpatchable SecureROM Boot-Chain Code Execution

Immediate actions

  • Inventory all A12/A13 (and S4/S5) devices in the fleet: iPhone XS/XS Max/XR, iPhone 11/11 Pro/11 Pro Max, iPhone SE 2nd gen, iPad Air 3, iPad mini 5, iPad 8th gen, Apple Watch Series 4/5/SE, HomePod mini
  • Treat physical possession of an affected device (even briefly, e.g. evil-maid/border/lost-device scenarios) as a potential boot-chain compromise; restrict unattended access to high-value devices
  • Where supervised/MDM-managed, monitor for unexpected DFU-mode entries and USB device-descriptor/serial anomalies (e.g. 'PWND' substrings) during device handling

Workarounds

  • No software patch is possible — SecureROM is mask-ROM burned into the SoC at fabrication
  • Reduce exposure by maintaining physical control of devices and minimizing time in DFU/recovery handling by untrusted parties
  • Strong passcodes and Secure Enclave protections still apply to data-at-rest because SEP is not compromised, but offer limited protection against the boot-chain threat model itself

Longer-term hardening

  • Prioritize replacement of A12/A13-class devices with A14+ silicon, which correctly programs DART in SecureROM and is not exploitable
  • For high-threat-model users, retire affected hardware from sensitive roles rather than relying on software mitigations
  • Enforce mobile device management with attestation and disable unnecessary trust of host computers; require re-pairing after any custody gap

Weaknesses (CWE) in usbliter8 — Unpatchable SecureROM Boot-Chain Code Execution

CWE-124, CWE-787, CWE-119, CWE-1247, CWE-1190

Timeline of usbliter8 — Unpatchable SecureROM Boot-Chain Code Execution

  • checkm8 SecureROM exploit publicly disclosed, permanently placing A5-A11 Apple devices outside Apple's patch authority — the closest public precedent to usbliter8.
  • First media reporting of the A12/A13 SecureROM boot-chain exploit (AppleInsider, GBHackers, CyberSecurityNews, CyberPress).
  • Paradigm Shift published the usbliter8 exploit code (public proof-of-concept) to github.com/prdgmshift/usbliter8 following coordinated disclosure with Apple.
  • Paradigm Shift published the usbliter8 technical write-up at ps.tc/pages/blog-usbliter8.html detailing the DWC2 DMA underflow, DART bypass, and PAC bypass.
  • Paradigm Shift completed coordinated disclosure to Apple Product Security ahead of publication (sources state private pre-publication reporting to Apple; no exact private date was published).
  • Threat documented in the Threadlinqs Intelligence Platform (TL-2026-0876).
  • As of this date no CVE, CVSS score, Apple advisory, or CISA alert had been issued, and no in-the-wild exploitation had been reported.
  • The Hacker News and CyberInsider report on usbliter8, confirming the RP2350-based microcontroller board requirement and sub-two-second execution.

Sources cited for usbliter8 — Unpatchable SecureROM Boot-Chain Code Execution

Threats related to usbliter8 — Unpatchable SecureROM Boot-Chain Code Execution

Detection coverage for TL-2026-0876

As of 2026-06-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0876 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats