Threat video1:00
CVE-2025-43504 Xcode LLDB Overflow: Detection & IOCs
LLDB debugserver's pre-auth qSpeedTest overflow is fixed in Xcode 26.1. 9 detection rules (one free in Splunk SPL) and 5 IOCs cover 3 ATT&CK techniques.
Read the full threat intel for CVE-2025-43504 Xcode LLDB Overflow: Detection & IOCs →
Chapters
- 0:00The hookResearchers reproduced a debugserver buffer overflow flaw.
- 0:05The storyThe flaw lives in the debugserver protocol.
- 0:11Attack pathAttacker reaches the exposed debugserver port.
- 0:25AttributionNo threat actor: this was defensive research.
- 0:30Indicators of compromise5 indicators to hunt: 2 SHA-1 hashes, 1 file name and 1 path, and more.
- 0:38MITRE ATT&CK techniques3 ATT&CK techniques, from initial access to impact.
- 0:43Remediation3 steps now: Do not expose the debugserver TCP port to untrusted networks.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Researchers reproduced a debugserver buffer overflow flaw.
0:05The flaw lives in the debugserver protocol.
0:08It causes denial of service.
0:11Attacker reaches the exposed debugserver port.
0:14Sends an oversized qSpeedTest packet.
0:17Buffer overflow corrupts adjacent globals.
0:20Service crashes and denies.
0:26No threat actor: this was defensive research.
0:305 indicators to hunt: 2 SHA-1 hashes, 1 file name and 1 path, and more.
0:383 ATT&CK techniques, from initial access to impact.
0:433 steps now: Do not expose the debugserver TCP port to untrusted networks.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.