# Apple patches debugserver pre-auth overflow bug Published: 2025-12-08 · Severity: routine · Sectors: technology Canonical: https://vorant.io/reports/1328a2d3-9455-5ef3-ae6b-84eecc05cb83/apple-patches-debugserver-pre-auth-overflow-bug > A researcher found a remote pre-authentication buffer overflow in LLDB's debugserver (CVE-2025-43504), now patched by Apple in Xcode 26.1. Nathaniel Oh, in a guest post on Objective-See, details CVE-2025-43504, a global buffer overflow he discovered in the qSpeedTest handler of LLDB's debugserver, the daemon Xcode uses to debug apps on physical iOS devices once a Developer Disk Image is mounted and paired. The RNBRemote::HandlePacket_qSpeedTest function accepts an unauthenticated qSpeedTest:response_size:; packet and uses the attacker-controlled response_size value in a memset call that writes past a fixed 4MB+16-byte static buffer (g_data), corrupting adjacent structures in debugserver's .bss segment without any prior authentication check. The write-up walks through practical exploitation limits: the attacker only controls the length of overflow, not its content (a fixed stream of 'a' bytes), which constrains impact largely to denial-of-service and partial pointer corruption. The researcher demonstrated crashing debugserver by corrupting a neighboring log-callback function pointer and later a pthread mutex, showing some primitive control over memory but no reliable path to full code execution due to program aborts and alignment issues introduced by the null-terminated overflow. Apple's fix, shipped in Xcode 26.1, moves the buffer to the heap and imposes a 4MB size cap on tested responses. This is a responsibly-disclosed and already-patched research finding rather than an actively exploited threat; risk is limited to scenarios where an attacker can reach a device's debugserver over a GDB-remote session (typically requiring a mounted Developer Disk Image), making real-world exploitation opportunities narrow. The technical detail is valuable for developers and security researchers auditing debugging infrastructure and highlights the value of examining open-source dependencies (LLVM/LLDB) underlying closed Apple platforms. ## Mentioned in this report - Vulnerabilities: CVE-2025-43504 1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers. Source reporting: https://objective-see.org/blog/blog_0x83.html --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1328a2d3-9455-5ef3-ae6b-84eecc05cb83/apple-patches-debugserver-pre-auth-overflow-bug. Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup