Google Project Zero Discloses Apple Vulnerability Allowing ASLR Bypass

Google Project Zero has disclosed a vulnerability in Apple’s macOS and iOS systems that could allow an ASLR bypass through pointer leaks in the NSKeyedArchiver serialization framework. According to gbhackers, the flaw exploits pointer-keyed data structures to leak memory addresses without requiring memory safety violations or timing attacks, and the attack operates when an app deserialises attacker-provided data, re-serialises the objects, and returns the data to the attacker.

The researchers demonstrated the technique in an artificial test case, using a method that involves NSNull and NSDictionary hash table manipulation to reveal memory addresses via the order of keys in re-serialised objects, with the method relying on around 50KB of specially crafted data. Apple addressed the vulnerability in their security releases on 31 March 2025, with mitigation emphasising avoiding object addresses as keys or using keyed hash functions to limit leaks to pointer equality.

Project Zero reported the issue directly to Apple, rather than filing it in the public bug tracker, and there is no identified real-world attack surface at the time of disclosure, though the work shows how pointer-based hashing could facilitate information disclosure and potentially assist other exploits. 29 September 2025.