Case study

AppleAVE2: reconstructing the IOKit wire format and driver validation path

The AppleAVE2 investigation maps the kernel driver's IOKit user-client selectors and input structures while examining the work-buffer size calculation associated with CVE-2026-64747. It includes a userspace reachability program, wire-format notes, overflow arithmetic and patched-host logs. The author reports that a hardware capability gate prevented a live overflow on that host.

Targets: Binary · Protocol
Category: Independent reconstruction cases
Relationship: Independent reconstruction project
Sources reviewed: 2026-11-06
Evidence class: C2 code & docs, no demo or download

Stars: 2
Last commit: 2026-09-05
Language: C

GitHub data as of 2026-11-10

Copy as Markdown View JSON Cite

Evidence

Observed: Code and documentation observed; no download method or demo found.
Checked: 2026-11-08

How evidence classes are assigned

Requirements & limits

Prerequisites: Building the reachability program requires an arm64 macOS environment with clang, IOKit and CoreFoundation.
Limits: The reported host runs the fixed AppleAVE2 905.40.1 build; its capability gate rejects the overflow dimensions before the calculator runs.
License: No licence file in the repository.

Cite

BibTeX

@misc{appleave2-wire-format-case,
  title = {{AppleAVE2: reconstructing the IOKit wire format and driver validation path}},
  howpublished = {\url{https://github.com/eddinos2/CVE-2026-64747}},
  url = {https://github.com/eddinos2/CVE-2026-64747},
  urldate = {2026-11-06},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/appleave2-wire-format-case/}}
}

Plain text

AppleAVE2: reconstructing the IOKit wire format and driver validation path. https://github.com/eddinos2/CVE-2026-64747 (accessed 2026-11-06). Awesome REA entry: https://awesomerea.org/resources/appleave2-wire-format-case/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · eddinos2/CVE-2026-64747 · Revision c62251c
WIRE_FORMAT.md GitHub · eddinos2/CVE-2026-64747 · Revision c62251c