## https://sploitus.com/exploit?id=51484E39-6BF4-5D2B-989C-CCECF5059EA4
# CVE-2026-43813 โ CloudAttestation `enforceEnvironment` bypass
Reverse-engineered analysis of the PCC attestation input-validation bug
Apple shipped as iOS 26.6, found in `CloudAttestation.dylib`.
## TL;DR
`PCC.ComputeNodeValidator.policy.getter` reads the
`com.apple.CloudAttestation.environment` byte from the unverified
**darwinInit** dictionary inside the `AttestationBundle` protobuf and
stuffs it straight into the `NodeValidator.policy` returned to the caller.
The 26.6 fix introduces a new struct field that is supposed to gate that
read on the system policy key `enforceEnvironment` in the
`com.apple.CloudAttestation` domain โ but that field was **never
initialised in 26.5**, so the gate was effectively absent and a crafted
PCC attestation bundle could set an attacker-chosen environment value into
the validator's policy chain.
The byte itself doesn't unlock anything by itself โ it has to match the
caller-supplied `expected` parameter to pass `EnvironmentPolicy.evaluate`,
and the rest of the production policy stack (`requireProdTrustAnchors`,
`requireProdFusing`, `requireLockedCryptexes`, `restrictDeveloperMode`,
`strictCertificateValidation`, `transparencyProofValidation`,
`ensembleTopologyValidation`) is read from `os_policy_lookup`, not from
the bundle.
## Binaries included in the repo
| Build | Path | Role |
|---|---|---|
| 23G5057c | `23G5057c_CloudAttestation` | 26.6 beta 4 (**vulnerable**) |
| 23G5065a | `23G5065a_CloudAttestation` | 26.6 beta 5 (**patched**) |
| โ | `23G5065a_CloudAttestation_vs_23G5057c_CloudAttestation.BinDiff` | The diff between them |
IDA databases (`.i64`), BinExport dumps, and other in-between builds are
gitignored.
## Vulnerable / patched addresses
| Symbol | 23G5057c (vuln) | 23G5065a (patched) |
|---|---|---|
| `PCC.ComputeNodeValidator.policy.getter` | `0x235e16f5c` (0x1c4) | `0x235e02fa8` (0x1dc) |
| `PCC.ComputeNodeValidator.init(proxyingAttestation:)` | `0x235e15ca0` | `0x235e01bf4` |
| Init `enforceEnvironment` lookup helper | *(missing)* | `0x235ed01cc` |
| `DarwinInit.environment.getter` | `0x235edc880` | same |
Bindiff similarity for the patched pair: **0.68**.
## Files
- [WRITEUP.md](WRITEUP.md) โ full reverse-engineering writeup (data flow,
fix patch, why it's PCC-internal not app-signing-internal)
- [WHY-NOT-SIDELOADING.md](WHY-NOT-SIDELOADING.md) โ short threat-model
coda explaining why this CVE can't be turned into a
TrollStore-style exploit
- [NOTES.md](NOTES.md) โ analysis scratchpad
- `CVE-2026-43813.txt` โ original CVE description (verbatim from VulDB)
- `releases.txt` โ build IDs in chronological order
## Note
This research was heavily assisted by MiniMax-M3.
Keep that in mind when reading the writeups โ none of the analysis is
independently verified, and any quoted decompilation, address, or
similarity score should be re-checked before relying on it.