Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529

Researchers at Google Project Zero discovered and exploited a type confusion vulnerability (CVE-2024-54529) in the coreaudiod system daemon within macOS. The vulnerability, along with a double-free vulnerability (CVE-2025-31235), stemmed from a process called knowledge-driven fuzzing. Initial attempts to directly write to the vulnerable offset failed due to a CFString header constraint, leading to a new strategy involving uninitialized memory in the ngne object. However, this was thwarted by macOS's malloc_tiny zone secure zeroing. Ultimately, the exploit was achieved by leveraging startup ngne objects and a carefully crafted heap spray, bypassing the secure zeroing mechanism. The vulnerability allowed for arbitrary code execution.