Type Confusion in macOS coreaudiod (CVE‑2024‑54529) Enables Local Privilege Escalation

Type Confusion in macOS coreaudiod (CVE‑2024‑54529) Enables Local Privilege Escalation

What It Is — Project Zero disclosed a type‑confusion flaw (CVE‑2024‑54529) in the com.apple.audio.audiohald Mach service of the CoreAudio framework, exercised by the coreaudiod daemon. The bug arises when a Mach message‑handler fetches a HALS_Object from an internal map and invokes a virtual method assuming the object is of type ioct without validating its actual class. An attacker who can send a crafted Mach message can cause an out‑of‑bounds virtual call, leading to a crash that can be chained into arbitrary code execution with kernel‑level privileges. A second, related double‑free (CVE‑2025‑31235) was also disclosed, but the type‑confusion issue is the focus of this brief. The vulnerabilities are currently unpatched; Apple has acknowledged the findings and is expected to issue a security update. CVSS (when published) is anticipated in the high range.

Affected Products — macOS (all versions shipping the vulnerable CoreAudio framework; specific version ranges not yet disclosed).

Why It Matters for Trust & Control Assurance — Demonstrates the need for a robust vulnerability‑management control that continuously discovers, assesses, and remediates software flaws across the OS stack.

Recommended Actions —

• Monitor Apple security advisories and apply the forthcoming patch as soon as it is released.
• Deploy endpoint‑level monitoring to detect anomalous Mach‑message activity or unexpected coreaudiod crashes.
• If you manage macOS fleets via MDM, enforce the latest OS version and consider temporary mitigation (e.g., restricting audio‑related Mach services).
• Record the detection, assessment, and remediation steps as audit evidence for your vulnerability‑management program.

Source: Project Zero – Breaking the Sound Barrier, Part II