Nasty screen sharing vulnerability in macOS: Exploit built from Apple's patch
Users of Apple's practical screen sharing function on Mac must update their operating system. An exploit could be developed quickly.
Apple Remote Desktop in an older version: Remote maintenance possible by attackers.
(Image: Apple)
Users who use the Screen Sharing function in macOS should update their Macs to the latest version as soon as possible: A team of security researchers has succeeded in developing an exploit from Apple's patch from this week. According to the AI-focused security company calif.io, it took a total of four hours to build the necessary software – using reverse engineering of macOS 26.6.1.
Although the exploit, which represents a total of two pre-auth remote attacks, has not been published (Proof of Concept see X-posting below), if a company can implement this using AI, other attackers are likely to do so as well. In addition to macOS 26.6.1, Apple had also patched the vulnerabilities in macOS 14.8.9 (Sonoma) and 15.7.9 (Sequoia).
At least 40,000 machines on the internet
Users who have Screen Sharing active are vulnerable – those whose corresponding ports are accessible from the internet are in the worst situation. The original discoverer of the problem, who did not report the vulnerabilities to Apple – they likely existed for quite some time before being found by other security researchers – determined per scan a total of 40,000 machines where this was possible. Screen Sharing or sharing the screen allows for complete remote maintenance of the Mac as if one were at the machine. The function is part of macOS; professionals also use Apple Remote Desktop, which builds on it and contains additional administration tools.
Videos by heise
As it now turns out, Apple apparently needed several attempts to fix the screen sharing problem. For example, macOS 26.6, macOS 15.7.8, and macOS 14.8.8 already contained three fixes in the screen sharing server, although Apple only mentioned “intercepting network connections of another process”, a denial-of-service attack, and finding a legacy VNC password (Sonoma / Sequoia) or accessing “sensitive data”. Some of these problems – like many vulnerabilities today – were discovered using AI, in this case GPT-5.5.
AI accelerates exploit creation from patch
The original discoverer of the problem, according to his own statements, @osxreverser, does not trust Apple's bug bounty program, saying it's not fair. That's why he didn't report the problem, but, as he also wrote, he didn't sell the zero-day either – that's not “his business”. Apparently, he found the screen sharing vulnerability quite normally “manually”, not using AI.
The incident shows how the security landscape has changed due to AI tools – these help both attackers and defenders, but also make it possible to create exploits from published fixes extremely quickly. Security researchers examine Apple's update and compare it to the previous version – reverse engineering is then done through disassembly. A software provider can do nothing about it; it only shows that users should update as soon as possible.
Empfohlener redaktioneller Inhalt
Mit Ihrer Zustimmung wird hier ein externer Preisvergleich (heise Preisvergleich) geladen.
Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden. Damit können personenbezogene Daten an Drittplattformen (heise Preisvergleich) übermittelt werden. Mehr dazu in unserer Datenschutzerklärung.
(bsc)
