[user214412412]

is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?

[Hilift]

Apple should formalize the iMessage de facto DeviceAndAccountTakeover() API call. I lost count how many zero-click it has. Tim Apple can take the privacy high road all day but it doesn't matter if the code is rotten.

https://citizenlab.ca/2025/06/first-forensic-confirmation-of...

https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...

https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage...

https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac...

[muricula]

Look up iMessage's "blastdoor" sandbox: https://support.apple.com/guide/security/blastdoor-for-messa...

[kaladin-jasnah]

FORCEDENTRY bypassed this sandbox IIRC. That was a bug in the JBIG2 decoder.

[GoblinSlayer]

Also image formats are fairly stable, so they are a good candidate for a verified F* parser. Not sure how easy it is for pdf, maybe start with a reasonable subset of it.

[mschuster91]

Good luck doing that for stuff like PDF which can include JavaScript in the PDF file itself, or SVG+PDF which both can include raw font files, another reliable source of exploits.

[GoblinSlayer]

PDF/A-1 and PDF/UA require unicode mapping, so embedded font files might be not as critical, you can just render unicode text, and javascript is routinely banned for being inaccessible.

[Wowfunhappy]

Do any PDF readers other than Adobe's support JS? Apple's certainly does not, unless something has changed recently.

[jimmyl02]

unfortunately sandboxes also have bugs which allows for RCE. this is typically called a "full chain" because it chains together a series of bugs (initial decoder exploit + sandbox escape exploit) to gain full RCE

[saagarjha]

This isn't just an iOS thing, and they do sandbox it. Parsers are hard.

[ladyanita22]

For some reason, Apple seems reluctant about using Rust on their operating systems.

[steve1977]

That reason is probably called Swift. But they obviously still have many many system libraries written in Objective-C, plain C or C++.

I don't see them using Rust when they have their own language under their full control, especially since both are targeting LLVM anyway.