Apple patches debugserver pre-auth overflow bug

A researcher found a remote pre-authentication buffer overflow in LLDB's debugserver (CVE-2025-43504), now patched by Apple in Xcode 26.1.

Nathaniel Oh, in a guest post on Objective-See, details CVE-2025-43504, a global buffer overflow he discovered in the qSpeedTest handler of LLDB's debugserver, the daemon Xcode uses to debug apps on physical iOS devices once a Developer Disk Image is mounted and paired. The RNBRemote::HandlePacket_qSpeedTest function accepts an unauthenticated qSpeedTest:response_size:<hex>; packet and uses the attacker-controlled response_size value in a memset call that writes past a fixed 4MB+16-byte static buffer (g_data), corrupting adjacent structures in debugserver's .bss segment without any prior authentication check.

The write-up walks through practical exploitation limits: the attacker only controls the length of overflow, not its content (a fixed stream of 'a' bytes), which constrains impact largely to denial-of-service and partial pointer corruption. The researcher demonstrated crashing debugserver by corrupting a neighboring log-callback function pointer and later a pthread mutex, showing some primitive control over memory but no reliable path to full code execution due to program aborts and alignment issues introduced by the null-terminated overflow. Apple's fix, shipped in Xcode 26.1, moves the buffer to the heap and imposes a 4MB size cap on tested responses.

This is a responsibly-disclosed and already-patched research finding rather than an actively exploited threat; risk is limited to scenarios where an attacker can reach a device's debugserver over a GDB-remote session (typically requiring a mounted Developer Disk Image), making real-world exploitation opportunities narrow. The technical detail is valuable for developers and security researchers auditing debugging infrastructure and highlights the value of examining open-source dependencies (LLVM/LLDB) underlying closed Apple platforms.

Source reporting: https://objective-see.org/blog/blog_0x83.html