Threat reportVulnerabilityTL-2026-4888
Objective-See 'Hidden Treasures of Crash Reports': macOS/iOS crash-derived bugs incl. unpatched nesessionmanager format-string DoS (macOS 15 betas) that disables all Network Extensions
Objective-See 'Hidden Treasures of Crash Reports' (TL-2026-4888), also tracked as The Hidden Treasures of Crash Reports, is a low-severity software vulnerability, first published 2026-10-31. It has no confirmed attribution, affects Apple macOS (Network Extension Session Manager, nesessionmanager), maps to 3 MITRE ATT&CK techniques (T1211, T1499.004, T1685), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- LOWAssessed severity
- CVEs
- 0None referenced
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4888
- Threat ID
- TL-2026-4888
- Also known as
- The Hidden Treasures of Crash Reports, Objective-See Blog 0x7B
- Severity
- LOW
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Objective-See 'Hidden Treasures of Crash Reports'
Malware and tooling: LockBit, Stuxnet - S0603, ZuRu, Console.app, YARA
How Objective-See 'Hidden Treasures of Crash Reports' works
Patrick Wardle's Objective-See Blog 0x7B describes four bugs found by analyzing crash reports: a YARA macOS crash (missing MAP_RESILIENT_CODESIGN), a kernel out-of-bounds read in socket path validation, an iOS NULL-pointer dereference in locale-based censorship code, and a 0day in the root daemon nesessionmanager (macOS 15 betas) whose format-string mismatch crashes it and disables all network extensions, including security tools. No CVE, CVSS, in-the-wild exploitation or attribution is stated in the source.
The Objective-See post (2024-08-13) argues that crash reports are an under-used source of vulnerability and malware discovery, citing historical examples: Stuxnet was noticed because it crashed systems, the ZuRu macOS malware was surfaced through crash reports, the LockBit macOS ransomware crashed prematurely and needed binary patching for complete analysis, MS08-067 was found from two crash reports among millions collected via Windows Error Reporting, and the July 2024 CrowdStrike Falcon sensor incident was an out-of-bounds read in a kernel driver that was initially mischaracterized as a NULL-pointer dereference.
Four bugs are detailed. (1) YARA on macOS: scanning files with invalid code signatures terminated the scanning process with EXC_BAD_ACCESS (Code Signature Invalid) because open-source YARA did not pass the MAP_RESILIENT_CODESIGN flag to mmap; reported by Wardle as VirusTotal/yara issue #1309 (2020-06-17) and fixed in filemap.c. (2) Kernel out-of-bounds read: open-source kernel code that checks sun->sun_path[slen] != 0 when validating socket paths read outside allocated memory and panicked the kernel (faulting address 0xffffff800892544b) when triggered by user-mode tools inspecting sockets; per the post, Apple's initial patch introduced a kernel information leak and the same function contained an additional heap overflow. (3) iOS: sending or typing the Taiwan flag emoji crashed the device because CFLocaleGetValue's return value was not NULL-checked before comparison with 'CN' in censorship logic; fixed, with the censorship behavior retained.
(4) The 0day: the root daemon nesessionmanager, which governs all network extensions, requests a localized string with format specifiers '%@ %@ %@ %s' but the localized text ('System extension %@ has an invalid %@ key in its Info.plist: The value of the %@ key must be prefixed with one of the App Groups in the %@ entitlement.') ends in %@ instead of %s. Passing a C string where an Objective-C object is expected crashes the daemon. Loading a corrupted network extension with invalid Mach service names triggers the path. Impact is a denial of service on the Network Extension subsystem: firewalls, network monitors and other security tools built on network extensions stop functioning until the daemon restarts. The post reports it as unpatched on macOS 15 betas at publication; patch status has NOT been re-verified (an NVD/Apple search for a matching CVE found no confirmed link; CVE-2025-24199 is a Foundation format-string DoS credited to another researcher and is not asserted to be this bug). Severity is low: local, requires the ability to load a malformed extension, and no exploitation in the wild is reported.
MITRE ATT&CK techniques used in TL-2026-4888
Stealth
T1211 Exploitation for Stealth
Impact
T1499.004 Application or System Exploitation
Defense Impairment
Affected products and versions in Objective-See 'Hidden Treasures of Crash Reports'
- Apple — macOS (Network Extension Session Manager, nesessionmanager)
Vulnerable versions: macOS 15 betas (and earlier per source) - Apple — macOS kernel (socket path validation, sun_path)
Vulnerable versions: version not stated in source
Fixed in: fixed by Apple per source; the initial patch introduced an information leak - Apple — iOS (locale-based censorship code, CFLocaleGetValue)
Vulnerable versions: version not stated in source
Fixed in: fixed per source - VirusTotal — YARA (macOS file mapping)
Vulnerable versions: releases prior to June 2020 fix
Fixed in: builds containing commit 6eb7cef / 5fd5cd7
Remediation for Objective-See 'Hidden Treasures of Crash Reports'
Patches
- Move to a current GA macOS release and verify nesessionmanager behavior; patch status of the 0day was not verified from the source
- YARA: fix in VirusTotal/yara filemap.c (commit 6eb7cef, follow-up 5fd5cd7)
Immediate actions
- Monitor for unexpected nesessionmanager crashes in /Library/Logs/DiagnosticReports/ (.ips) and alert on network-extension-based security tools going offline
- Do not run macOS 15 beta builds on endpoints that depend on network-extension security tooling
Workarounds
- Restrict installation of unsigned or malformed system extensions through MDM approval policies
Longer-term hardening
- Upgrade YARA-based scanners to releases containing the MAP_RESILIENT_CODESIGN fix
- Enable watchdog/health checks for EDR, firewall and DNS-filter system extensions with automatic re-enable and alerting
- Restrict who can install or load system/network extensions via MDM
Weaknesses (CWE) in Objective-See 'Hidden Treasures of Crash Reports'
Timeline of Objective-See 'Hidden Treasures of Crash Reports'
- Historical context cited in the post: MS08-067 0day was found via two crash reports among millions collected by Windows Error Reporting
- Wardle opens VirusTotal/yara issue #1309: YARA crashes on macOS with EXC_BAD_ACCESS (Code Signature Invalid)
- YARA fix commit 6eb7cef adds MAP_RESILIENT_CODESIGN to file mmap calls
- YARA commit 5fd5cd7 adds both MAP_RESILIENT_MEDIA and MAP_RESILIENT_CODESIGN flags
- July 2024 CrowdStrike Falcon sensor kernel driver crash (out-of-bounds read, initially described as NULL dereference) referenced in the post
- Objective-See Blog 0x7B published, disclosing the nesessionmanager format-string 0day on macOS 15 betas as unpatched
- Patch status of the nesessionmanager issue remains unverified; no CVE, KEV entry or in-the-wild exploitation found
Sources cited for Objective-See 'Hidden Treasures of Crash Reports'
- The Hidden Treasures of Crash Reports (Objective-See, Patrick Wardle)
- The Hidden Treasures of Crash Reports (slides)
- Computer Crash Reports Are an Untapped Hacker Gold Mine (Wired)
- YARA issue #1309: crash on macOS (Code Signature Invalid)
- The Inside Story Behind MS08-067
- A Remote iOS Bug (Objective-See Blog 0x34)
- Apple, China Censorship, Bug, iPhone Crash, Emoji (Wired)
Detection coverage for TL-2026-4888
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4888 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.