# CVE-2025-43504: Remote Pre-Authentication Buffer Overflow in LLDB debugserver (Xcode / iOS Developer Disk Image)

> CVE-2025-43504 is a global (.bss) buffer overflow in LLDB's debugserver, triggered by a crafted qSpeedTest:response_size:<hex>; packet that is processed before any authentication. The attacker controls only the overflow length (fixed 'a' bytes), so practical impact is denial of service; Apple fixed it in Xcode 26.1 and a public PoC exists.

- **Published:** 2026-10-31T14:33:16Z
- **Last reviewed:** 2026-10-31T14:33:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4906
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4906.png
- **ID:** TL-2026-4906
- **Severity:** MEDIUM (CVSS 4.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 5 (2 shown free below)
- **CVEs:** CVE-2025-43504

## Description

LLDB's debugserver implements the GDB remote serial protocol. In RNBRemote::HandlePacket_qSpeedTest(), the handler copies the prefix "data:" into a static global buffer declared as char g_data[4 * 1024 * 1024 + 16] and then calls memset(g_data + 5, 'a', response_size) using the attacker-supplied, unvalidated response_size from the packet qSpeedTest:response_size:<hex>;. Because the packet is parsed before any authentication or session setup, any remote client able to reach the debugserver TCP port (commonly 1234) can trigger the overflow. Objective-See's analysis describes the reachable target as an iOS device with a Developer Disk Image mounted.

The overflow writes past the end of g_data into adjacent .bss globals, notably the g_log_callback function pointer and the g_LogThreadedMutex synchronization primitive. Observed behavior depends on overflow depth: an overflow reaching only offset 0x4004AB writes a single NULL byte with no crash; overflowing 0x4004AC-0x40052B corrupts g_log_callback and yields SIGBUS when it is dereferenced; 0x40052C-0x402C62 corrupts the pthread mutex and causes abort(); and 0x402C63 and beyond runs into the guard page, producing SIGBUS/SIGSEGV.

Exploitation is constrained: the attacker controls only the length of the write, and the written content is always ASCII 'a' (0x61), which prevents reliable pointer hijacking. With modern mitigations the realistic outcome is denial of service of the debug service, and code execution would require pairing with an additional vulnerability. The research includes a Python proof-of-concept that frames packets as $<payload>#<checksum> and sends oversized response_size values.

Apple remediated the issue in Xcode 26.1 (released 2025-11-03) with improved bounds checking. The upstream LLVM fix (commit ac8e7be5fbd11f731ffc81bf3bbae50a5a4d83de, '[lldb][debugserver] Max response size for qSpeedTest (#156099)') moves the buffer to a heap-allocated std::vector and rejects response sizes of 4MB or more. Note a scoring discrepancy between sources: NVD scores the flaw CVSS 4.9 (AV:N/AC:L/PR:H, availability impact only) and Apple describes it as exploitable by a user in a privileged network position, whereas Objective-See characterizes it as pre-authentication at the protocol level. No in-the-wild exploitation, threat actor attribution, or network IOCs are reported in any source.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1499.004 Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2025-43504 debugserver qSpeedTest Oversized response_size Packet — Exploitation** (`TL-2026-4906-SPL-001`)

Detects a GDB-remote qSpeedTest:response_size:<hex>; packet whose response_size is 4MB (0x400000) or larger, the size the upstream fix (LLVM ac8e7be) rejects. Sent to LLDB debugserver (commonly TCP/1234) it overflows the static g_data buffer in RNBRemote::HandlePacket_qSpeedTest before any authentication, corrupting g_log_callback and g_LogThreadedMutex and crashing debugserver (denial of service). A public PoC exists; no in-the-wild use is reported.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1203, T1499.004
- **Data sources:** stream:tcp, suricata_eve, network_traffic
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype="stream:tcp" "qSpeedTest:response_size:" earliest=-24h
| eval response_size_hex=replace(src_content,"(?s).*qSpeedTest:response_size:([0-9A-Fa-f]+);.*","\1")
| eval response_size=tonumber(response_size_hex,16)
| where response_size>=4194304
| stats count as packets min(_time) as first_seen max(_time) as last_seen max(response_size) as max_response_size values(dest_port) as dest_ports by src_ip dest_ip
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where Message has "qSpeedTest:response_size:" or AdditionalExtensions has "qSpeedTest:response_size:"
| extend Payload = strcat(Message, " ", AdditionalExtensions)
| extend ResponseSizeHex = extract(@"qSpeedTest:response_size:([0-9A-Fa-f]+);", 1, Payload)
| extend ResponseSize = tolong(strcat("0x", ResponseSizeHex))
| where ResponseSize >= 4194304
| summarize Packets = count(), MaxResponseSize = max(ResponseSize), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort
| project FirstSeen, LastSeen, SourceIP, DestinationIP, DestinationPort, Packets, MaxResponseSize
```

### Sigma

```yaml
title: LLDB debugserver qSpeedTest Oversized response_size Overflow Attempt (CVE-2025-43504)
id: 3b0a8c1e-4906-4f21-a001-5d1e7c2b9a01
status: experimental
description: Detects an IDS alert payload containing a GDB-remote qSpeedTest packet with response_size of 4MB or more, which overflows the static g_data buffer in LLDB debugserver pre-authentication.
references:
    - https://objective-see.org/blog/blog_0x83.html
    - https://support.apple.com/en-us/125641
    - https://github.com/llvm/llvm-project/commit/ac8e7be5fbd11f731ffc81bf3bbae50a5a4d83de
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/31
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1203
    - attack.impact
    - attack.t1499.004
    - cve.2025-43504
logsource:
    product: suricata
    service: eve
detection:
    selection:
        payload_printable|re: 'qSpeedTest:response_size:0*([4-9A-Fa-f][0-9A-Fa-f]{5}|[1-9A-Fa-f][0-9A-Fa-f]{6,});'
    condition: selection
falsepositives:
    - Fuzzing or protocol conformance testing of debugserver in a lab
    - Authorized penetration test replaying the public PoC
level: medium

```

**Known false positives:**

- Authorized security testing replaying the Objective-See PoC against a lab device
- Protocol fuzzers run by developer-tools teams against debugserver in an isolated network

**Tuning notes:** Requires full payload visibility (Splunk Stream src_content, Suricata payload_printable, or an NGFW/IDS that forwards payload into CommonSecurityLog). Add dest_port=1234 if your Stream capture covers many protocols. Values of 0x400000 and above are alerted because the fix rejects 4MB or more; the actual buffer overflow begins slightly above that (response_size > 0x40000A).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- debugserver qSpeedTest Packet Observed On The Wire — Exploitation Recon/Trigger (locked: unlock with TL Creds)
- Python Process Crafting qSpeedTest GDB-Remote Packets — PoC Execution And Crash Report (locked: unlock with TL Creds)
- Inbound Connection To debugserver Port 1234 From Unexpected Source (locked: unlock with TL Creds)
- debugserver Launched Listening On Non-Loopback Interface — Exploitation Exposure (locked: unlock with TL Creds)
- debugserver Terminated By SIGBUS/SIGSEGV/SIGABRT — Unified Log Exit Signature (locked: unlock with TL Creds)
- External Source Connecting To debugserver Port 1234 — Perimeter Exposure (locked: unlock with TL Creds)
- debugserver Repeated Crash Burst (SIGBUS/SIGSEGV/abort) — Impact (locked: unlock with TL Creds)
- debugserver Port 1234 Fan-Out From One Source — Lateral Scan (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 5)

Defanged, TLP:CLEAR.

- File hash: `ac8e7be5fbd11f731ffc81bf3bbae50a5a4d83de`
- File hash: `37cd595c1ccb1fd84ebdfeb0d959744a4d13726c`

Full set of 5 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [When Good /bins Go Bad: A Remote Pre-Authentication Overflow in LLDB's debugserver](https://objective-see.org/blog/blog_0x83.html)
- [About the security content of Xcode 26.1](https://support.apple.com/en-us/125641)
- [NVD - CVE-2025-43504](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-43504)
- [LLVM commit ac8e7be: lldbdebugserver Max response size for qSpeedTest (#156099)](https://github.com/llvm/llvm-project/commit/ac8e7be5fbd11f731ffc81bf3bbae50a5a4d83de)
- [LLVM pull request #156099: Max response size for qSpeedTest](https://github.com/llvm/llvm-project/pull/156099)
- [CVEmon: CVE-2025-43504](https://cvemon.intruder.io/cves/CVE-2025-43504)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4906