Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529

Researchers at Google Project Zero discovered and exploited a type confusion vulnerability (CVE-2024-54529) within the coreaudiod system daemon in macOS. The vulnerability, stemming from a double-free, allowed for heap manipulation and ultimately, exploitation. Initial attempts to directly write to the vulnerable offse…