Ilya Andr

Middle iOS R&D engineer @ Positive Technologies | apple bug hunter | 18 y. o.

[Ilya Andr @andrd3v]

@MchinaMd57764 🙏

[Ilya Andr @andrd3v]

Missed one more from the drop lol

CVE-2026-43783 - macOS LPE via DesktopServicesHelper. One XPC request -> arbitrary chown -> root.

PT SWARM writeup:
https://t.co/uEaHXKbLhb

My blog:
https://t.co/TlMOqux5lW

PoC:
https://t.co/qH1LnxXbjj

[Ilya Andr @andrd3v]

@dautovri 🙏🙏

[Ilya Andr @andrd3v]

CVE-2026-43664
CVE-2026-65345
CVE-2026-86905
CVE-2026-84606
CVE-2026-84625
CVE-2026-84623
CVE-2026-86878

[Ilya Andr @andrd3v]

@07finder Congrats!

[Ilya Andr @andrd3v]

@Xplo8E Grats!

[Ilya Andr @andrd3v]

@explise12 ty! 😃

[Ilya Andr @andrd3v]

@Xplo8E 🙏🙏

[Ilya Andr @andrd3v]

@D4RK7ET 🔥🔥

[Ilya Andr @andrd3v]

38 reports since February btw, with quite a few being similar issues - sounds bigger than it is.

[Ilya Andr @andrd3v]

Kinda bummed tbh - I had 38 reports marked for a Fall 2026 fix, but only 7 ended up shipping in this release.

Guess the rest are cooking for later lol.

[Ilya Andr @andrd3v]

@raptor_o10 Thanks! ☺️

[Ilya Andr @andrd3v]

@gergely_kalman Thank u!

[Ilya Andr @andrd3v]

@speedyfriend433 🎉🎉

[Vladislav Shevchenko @destr4ctt]

Sharing details & PoC for CVE-2026-43748, a heap OOB-write in ANEHWDevice::ANE_ProgramCheckandPrewireBuffers_gated (Apple Neural Engine)

Vulnerability was fixed in iOS 26.6 update. And for some reason, Apple missed me in advisory...

Frustrating :(

https://t.co/HAmApCS4EA

[Ilya Andr @andrd3v]

offzone 2026

[Ilya Andr @andrd3v]

@thedawgyg ok, thank u 😊

[Ilya Andr @andrd3v]

@thedawgyg Do you think they will update the list soon?

[Ilya Andr @andrd3v]

@thedawgyg I'm not the first to report the problem, I don't know

[Ilya Andr @andrd3v]

@Curb118 hello, my friend

[Ilya Andr @andrd3v]

🎉🎉