# Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529 (macOS CoreAudio coreaudiod type confusion, PoC public)

> Google Project Zero published a full exploitation write-up and open-source PoC for CVE-2024-54529, a type confusion in the com.apple.audio.audiohald Mach service of macOS coreaudiod that lets an app execute code outside its sandbox or with elevated privileges. Apple patched it in December 2024; no in-the-wild exploitation is reported.

- **Published:** 2026-10-29T07:26:33Z
- **Last reviewed:** 2026-10-29T07:26:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4713
- **ID:** TL-2026-4713
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-54529, CVE-2025-31235

## Description

CVE-2024-54529 is a type confusion in the com.apple.audio.audiohald Mach service hosted by the coreaudiod daemon (CoreAudio / Audio framework). Part I of the research (published 2025-05-09) notes the service is reachable from sandboxed processes such as Safari's GPU process, and that it exposes control of audio hardware, so it normally runs with elevated privileges. Multiple Mach message handlers, for example _XIOContext_Fetch_Workgroup_Port, look up a HALS_Object in the HALS_ObjectMap using an attacker-supplied object ID and then operate on it as an 'ioct' (IOContext) object without validating its real type. The code dereferences a pointer at offset 0x68 of the object and performs a virtual call at offset 0x168 of the pointed-to structure, so an attacker who controls that data controls the call target.

In the Project Zero exploit (Dillon Franke, Google Information Security Engineering), exploitation requires a three-level pointer chain: offset 0x68 of the confused object must point to attacker-controlled memory, whose offset 0x0 points to a fake vtable, whose offset 0x168 holds the target address. Heap grooming uses the HALS_Object_SetPropertyData_DPList API, which accepts serialized property lists and allocates CFArray, CFDictionary, CFString and CFData objects with controlled content. An 'ngne' object type (0x308 bytes, created only at startup) has an uninitialized 6-byte gap at offset 0x68; the last 2 bytes are zeroed because of compiler alignment of an adjacent short field. The crafted plist is persisted to /Library/Preferences/Audio/com.apple.audio.DeviceSettings.plist. The type confusion is first triggered to crash coreaudiod; on restart CASettingsStorage::RefreshSettings loads the plist from disk and CASettingsStorage::SaveSettings makes a copy, writes it to disk and frees the copy, so freed attacker data is reused by ngne allocations in non-zeroed malloc_small regions (malloc_tiny zeroing defeated the original spray). The vulnerability is then re-triggered against the ngne object whose pointer chain now points into attacker data. A return-oriented-programming chain stored in UTF-16 CFString objects (to avoid invalid UTF-8 bytes), entered via an xchg rsp, rax stack-pivot gadget and using gadgets from CoreAudio in the dyld shared cache (constant addresses until reboot), issues raw syscalls inside the coreaudiod process. The demonstration payload opens and writes /Library/Preferences/Audio/malicious.txt.

The researcher built a custom object dumper using Ivan Fratric's TinyInst Hook API to enumerate HALS_ObjectMap linked lists, used IDAPython scripts to find code paths writing to the critical offset after CopyObjectByObjectID calls, used Guard Malloc with PreScribble (0xAA fill) to confirm uninitialized-memory use, and used the XSystem_Get_Object_Info handler to enumerate ngne objects on demand. The PoC in the p0tools repository (exploit.mm, build_rop.py, run_exploit.py, reset-devices.sh, plus cve-2024-54529-poc-macos-sequoia-15.0.1.c) was demonstrated on macOS Sequoia 15.0.1 and is Intel (x86-64) specific; its README recommends SIP disabled for debugging. Running it makes the audio system unresponsive, causes repeated coreaudiod crashes and leaves thousands of spurious dummy audio devices in the audio configuration; run_exploit.py backs up the original configuration to default-plist.plist and reset-devices.sh restores it. Apple Silicon would additionally require correctly signing the pointers in the chain and the ROP gadgets (pointer authentication), which the PoC does not address.

The bug was reported to Apple on 2024-10-09 and Apple fixed it ('a logic issue was addressed with improved checks') in macOS Sequoia 15.2, Sonoma 14.7.2 and Ventura 13.7.2 on 2024-12-11, crediting Dillon Franke working with Google Project Zero. NVD scores it CVSS 3.1 7.8 (HIGH) and CISA SSVC lists exploitation as PoC. The article also references CVE-2025-31235, a related double free in coreaudiod found with the same knowledge-driven fuzzing (Jackalope and TinyInst) and fixed in macOS Sequoia 15.5, Sonoma 14.7.6, Ventura 13.7.6 and iPadOS 17.7.7; NVD scores it 6.5 MEDIUM (availability impact, 'unexpected system termination'), SSVC exploitation none. No threat-actor use, CISA KEV listing or network IOCs were found in the sources.

## MITRE ATT&CK

- T1587.004 Exploits
- T1559 Inter-Process Communication
- T1106 Native API
- T1211 Exploitation for Stealth
- T1499.004 Application or System Exploitation

## Sources

- [Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529 (Dillon Franke, Google Project Zero)](https://projectzero.google/2026/01/sound-barrier-2.html)
- [Breaking the Sound Barrier, Part I: Fuzzing CoreAudio with Mach Messages (Dillon Franke, Google Project Zero)](https://projectzero.google/2025/05/breaking-sound-barrier-part-i-fuzzing.html)
- [googleprojectzero/p0tools - CoreAudioFuzz (PoC and fuzzing harness)](https://github.com/googleprojectzero/p0tools/tree/master/CoreAudioFuzz)
- [CoreAudioFuzz exploit README (run flow, artifacts, reset-devices.sh)](https://github.com/googleprojectzero/p0tools/blob/master/CoreAudioFuzz/exploit/README.md)
- [NVD - CVE-2024-54529](https://nvd.nist.gov/vuln/detail/CVE-2024-54529)
- [NVD - CVE-2025-31235](https://nvd.nist.gov/vuln/detail/CVE-2025-31235)
- [Apple - About the security content of macOS Sequoia 15.2](https://support.apple.com/en-us/121839)
- [Apple - About the security content of macOS Sonoma 14.7.2](https://support.apple.com/en-us/121840)
- [Apple - About the security content of macOS Ventura 13.7.2](https://support.apple.com/en-us/121842)
- [Full Disclosure - APPLE-SA-2024-12 macOS Sequoia 15.2](http://seclists.org/fulldisclosure/2024/Dec/7)
- [Full Disclosure - APPLE-SA-2024-12 macOS Ventura 13.7.2](http://seclists.org/fulldisclosure/2024/Dec/9)
- [googleprojectzero/Jackalope (coverage-guided fuzzer)](https://github.com/googleprojectzero/Jackalope)
- [googleprojectzero/TinyInst (dynamic instrumentation library)](https://github.com/googleprojectzero/TinyInst)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4713