Apple patches debugserver pre-auth overflow bug
A researcher found a remote pre-authentication buffer overflow in LLDB's debugserver (CVE-2025-43504), now patched by Apple in Xcode 26.1.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Nathaniel Oh, in a guest post on Objective-See, details CVE-2025-43504, a global buffer overflow he discovered in the qSpeedTest handler of LLDB's debugserver, the daemon Xcode uses to debug apps on physical iOS devices once a Developer Disk Image is mounted and paired. The RNBRemote::HandlePacket_qSpeedTest function accepts an unauthenticated qSpeedTest:response_size:<hex>; packet and uses the attacker-controlled response_size value in a memset call that writes past a fixed 4MB+16-byte static buffer (g_data), corrupting adjacent structures in debugserver's .bss segment without any prior authentication check.
The write-up walks through practical exploitation limits: the attacker only controls the length of overflow, not its content (a fixed stream of 'a' bytes), which constrains impact largely to denial-of-service and partial pointer corruption. The researcher demonstrated crashing debugserver by corrupting a neighboring log-callback function pointer and later a pthread mutex, showing some primitive control over memory but no reliable path to full code execution due to program aborts and alignment issues introduced by the null-terminated overflow. Apple's fix, shipped in Xcode 26.1, moves the buffer to the heap and imposes a 4MB size cap on tested responses.
This is a responsibly-disclosed and already-patched research finding rather than an actively exploited threat; risk is limited to scenarios where an attacker can reach a device's debugserver over a GDB-remote session (typically requiring a mounted Developer Disk Image), making real-world exploitation opportunities narrow. The technical detail is valuable for developers and security researchers auditing debugging infrastructure and highlights the value of examining open-source dependencies (LLVM/LLDB) underlying closed Apple platforms.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x83.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs