# usbliter8 — Unpatchable SecureROM Boot-Chain Code Execution on Apple A12/A13 (and S4/S5) SoCs via DWC2 USB DMA Underflow

> Paradigm Shift disclosed 'usbliter8', a working SecureROM (boot ROM) exploit achieving arbitrary code execution on Apple A12/A13 and S4/S5 devices. A buffer underflow in the Synopsys DWC2 USB controller's DMA Setup-packet handling, combined with the USB DART (IOMMU) running in bypass mode inside SecureROM, lets a physically-present attacker in DFU mode overwrite SRAM and take program-counter control. Like 2019's checkm8, the flaw is burned into silicon and cannot be fixed by software. A public PoC exists; no in-the-wild exploitation has been reported.

- **Published:** 2026-06-19T00:00:00Z
- **Last reviewed:** 2026-06-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0876
- **ID:** TL-2026-0876
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 18-19 June 2026 the research group Paradigm Shift published 'usbliter8', the first public Apple boot ROM (SecureROM) code-execution exploit since checkm8 (2019), targeting the A12 and A13 application processors and the S4/S5 watch SoCs. The vulnerability is a hardware-level flaw in the Synopsys DesignWare USB 2.0 (DWC2) controller used by Apple's SecureROM USB stack. The controller stores incoming USB Setup packets via DMA, buffers up to three, then resets its write pointer on the fourth by decrementing it by a fixed 24 bytes. It also accepts smaller-than-standard Setup packets while only incrementing the write pointer by the number of bytes actually written. That mismatch accumulates into a repeatable buffer underflow that steps the DMA write pointer backwards through memory 12 bytes at a time.

What makes the underflow exploitable on A12/A13 is Apple's configuration of the USB DART (Device Address Resolution Table — the SoC's IOMMU) inside SecureROM: it runs in bypass mode, so the underflowing DMA pointer can reach and overwrite arbitrary SRAM. A11 is not affected because its SecureROM USB driver manually resets the DMA address after every packet, so the mismatch never accumulates; A14 and later correctly program DART in SecureROM, rendering the bug unexploitable on newer silicon.

On A12 the DMA buffer sits adjacent to the USB task's stack, so the underflow directly overwrites a saved link register (LR), granting program-counter control on the next context switch. A compact ROP chain then reprograms the DMA destination to target the boot trampoline (a region not writable from EL0/EL1 but reachable via DMA), injects attacker-controlled shellcode, and redirects execution to gain EL1 privileges. A13 adds Pointer Authentication (PAC), which blocks direct LR corruption; the researchers bypass it in stages — corrupting DART-related heap structures to create limited write primitives, overwriting the SecureROM panic depth counter so the chip loops on errors instead of rebooting (keeping the device alive through repeated exploitation attempts), and overwriting USB interrupt-handler pointers to reach execution. The attack hardware is an RP2350-based USB microcontroller board acting as the malicious USB host.

Post-exploitation, the attacker can inject custom USB request handlers, mark the device with a 'PWND:[usbliter8]' serial string within the active DFU session, demote the device from production mode, and boot unsigned iBoot images — stepping outside Apple's chain of trust before iOS loads. The attack requires physical possession, a USB connection, DFU mode, and a USB microcontroller board, and completes in under two seconds. It is a tethered boot-level compromise (it must be re-run on each boot); it does NOT directly compromise the Secure Enclave (SEP), which remains isolated, so user-data-at-rest protections and passcode-derived keys are not directly defeated, though it expands the attack surface against other parts of the platform. Paradigm Shift coordinated disclosure with Apple Product Security before publishing; as of 19 June 2026 no CVE, CVSS score, or in-the-wild exploitation has been assigned or reported.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1200 Hardware Additions
- T1091 Replication Through Removable Media
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1542 Pre-OS Boot
- T1211 Exploitation for Stealth
- T1553 Subvert Trust Controls
- T1014 Rootkit
- T1685 Disable or Modify Tools
- T1542 Pre-OS Boot
- T1005 Data from Local System
- T1495 Firmware Corruption
- T1490 Inhibit System Recovery

## Sources

- [Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain](https://thehackernews.com/2026/06/unpatchable-usbliter8-exploit-breaks.html)
- [Paradigm Shift — usbliter8 technical write-up](https://ps.tc/pages/blog-usbliter8.html)
- [Paradigm Shift usbliter8 exploit (public proof-of-concept)](https://github.com/prdgmshift/usbliter8)
- [Unpatchable BootROM exploit for Apple A12-A13 chips now public](https://cyberinsider.com/unpatchable-bootrom-exploit-for-apple-a12-a13-chips-now-public/)
- [A12 & A13 Apple devices face an unpatchable SecureROM vulnerability](https://appleinsider.com/articles/26/06/18/a12-a13-apple-devices-face-an-unpatchable-securerom-vulnerability)
- [New iPhone BootROM Flaw Enables Full Chain-of-Trust Compromise](https://cyberpress.org/new-iphone-bootrom-flaw/)
- [iPhone BootROM Vulnerability Opens Door to Full Apple SoC Trust Chain Compromise](https://gbhackers.com/iphone-bootrom-vulnerability/)
- [New iPhone BootROM Vulnerability Exposes Apple SoCs to Full Chain-of-Trust Compromise](https://cybersecuritynews.com/iphone-bootrom-vulnerability/)
- [MITRE ATT&CK — Pre-OS Boot (T1542)](https://attack.mitre.org/techniques/T1542/)
- [MITRE CWE-124: Buffer Underwrite ('Buffer Underflow')](https://cwe.mitre.org/data/definitions/124.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0876