SECURITY Signal 164
Apple Screen Sharing Pre-Auth RCE
↗
This is a critical-severity bug requiring no credentials, no user interaction, and no target-specific knowledge—only that Screen Sharing is enabled. An attacker can pipeline a single TCP connection to bypass authentication and write a root crontab plus reverse shell, achieving root RCE within 60 seconds.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The root cause is a bug in screensharingd's SRP frame-length validation where the 'frame too large' error path returns the stale success value (0) from a prior 4-byte read instead of an error code, causing the caller to treat the session as fully authenticated.
After the auth bypass, the attacker can use Apple's proprietary file-copy protocol (RFB message type 0x22) to perform arbitrary file read and write as root, enabling deployment of a Perl reverse shell via a root crontab entry.
The vulnerability affects macOS ≤ 26.5 (Tahoe) and is fixed in macOS 26.6; the only prerequisite is that Screen Sharing is enabled (System Settings → General → Sharing → Screen Sharing).
THE CLUSTER