# Objective-See 'Hidden Treasures of Crash Reports': macOS/iOS crash-derived bugs incl. unpatched nesessionmanager format-string DoS (macOS 15 betas) that disables all Network Extensions

> Patrick Wardle's Objective-See Blog 0x7B describes four bugs found by analyzing crash reports: a YARA macOS crash (missing MAP_RESILIENT_CODESIGN), a kernel out-of-bounds read in socket path validation, an iOS NULL-pointer dereference in locale-based censorship code, and a 0day in the root daemon nesessionmanager (macOS 15 betas) whose format-string mismatch crashes it and disables all network extensions, including security tools. No CVE, CVSS, in-the-wild exploitation or attribution is stated in the source.

- **Published:** 2026-10-31T07:47:28Z
- **Last reviewed:** 2026-10-31T07:47:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4888
- **ID:** TL-2026-4888
- **Severity:** LOW
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Objective-See post (2024-08-13) argues that crash reports are an under-used source of vulnerability and malware discovery, citing historical examples: Stuxnet was noticed because it crashed systems, the ZuRu macOS malware was surfaced through crash reports, the LockBit macOS ransomware crashed prematurely and needed binary patching for complete analysis, MS08-067 was found from two crash reports among millions collected via Windows Error Reporting, and the July 2024 CrowdStrike Falcon sensor incident was an out-of-bounds read in a kernel driver that was initially mischaracterized as a NULL-pointer dereference.

Four bugs are detailed. (1) YARA on macOS: scanning files with invalid code signatures terminated the scanning process with EXC_BAD_ACCESS (Code Signature Invalid) because open-source YARA did not pass the MAP_RESILIENT_CODESIGN flag to mmap; reported by Wardle as VirusTotal/yara issue #1309 (2020-06-17) and fixed in filemap.c. (2) Kernel out-of-bounds read: open-source kernel code that checks sun->sun_path[slen] != 0 when validating socket paths read outside allocated memory and panicked the kernel (faulting address 0xffffff800892544b) when triggered by user-mode tools inspecting sockets; per the post, Apple's initial patch introduced a kernel information leak and the same function contained an additional heap overflow. (3) iOS: sending or typing the Taiwan flag emoji crashed the device because CFLocaleGetValue's return value was not NULL-checked before comparison with 'CN' in censorship logic; fixed, with the censorship behavior retained.

(4) The 0day: the root daemon nesessionmanager, which governs all network extensions, requests a localized string with format specifiers '%@ %@ %@ %s' but the localized text ('System extension %@ has an invalid %@ key in its Info.plist: The value of the %@ key must be prefixed with one of the App Groups in the %@ entitlement.') ends in %@ instead of %s. Passing a C string where an Objective-C object is expected crashes the daemon. Loading a corrupted network extension with invalid Mach service names triggers the path. Impact is a denial of service on the Network Extension subsystem: firewalls, network monitors and other security tools built on network extensions stop functioning until the daemon restarts. The post reports it as unpatched on macOS 15 betas at publication; patch status has NOT been re-verified (an NVD/Apple search for a matching CVE found no confirmed link; CVE-2025-24199 is a Foundation format-string DoS credited to another researcher and is not asserted to be this bug). Severity is low: local, requires the ability to load a malformed extension, and no exploitation in the wild is reported.

## MITRE ATT&CK

- T1499.004 Application or System Exploitation
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth

## Sources

- [The Hidden Treasures of Crash Reports (Objective-See, Patrick Wardle)](https://objective-see.org/blog/blog_0x7B.html)
- [The Hidden Treasures of Crash Reports (slides)](https://speakerdeck.com/patrickwardle/the-hidden-treasure-of-crash-reports)
- [Computer Crash Reports Are an Untapped Hacker Gold Mine (Wired)](https://www.wired.com/story/crash-reports-vulnerability-data/)
- [YARA issue #1309: crash on macOS (Code Signature Invalid)](https://github.com/VirusTotal/yara/issues/1309)
- [The Inside Story Behind MS08-067](https://github.com/JohnLaTwC/Shared/blob/master/The%20Inside%20Story%20Behind%20MS08-067.md)
- [A Remote iOS Bug (Objective-See Blog 0x34)](https://objective-see.org/blog/blog_0x34.html)
- [Apple, China Censorship, Bug, iPhone Crash, Emoji (Wired)](https://www.wired.com/story/apple-china-censorship-bug-iphone-crash-emoji/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4888