Exploit for NULL Pointer Dereference in Pgbouncer

## https://sploitus.com/exploit?id=5C4FA588-9846-5874-951A-E9280C7D194D
---

## CVE-2026-6666 – XPC Service NSKeyedUnarchiver Deserialization Attack (macOS/iOS simulation)

### **Program Code (Python simulation)**

```python
#!/usr/bin/env python3
# vulnerable_xpc_service.py - Simulated XPC service using unsafe plist deserialization
import plistlib, subprocess, socketserver, struct

# Mach message simulation: we just accept a binary plist over TCP.
class XPCHandler(socketserver.BaseRequestHandler):
    def handle(self):
        raw = self.request.recv(4096)
        # Insecure: using plistlib.loads on untrusted data without sanitization
        plist_data = plistlib.loads(raw)  # In real macOS, NSKeyedUnarchiver can execute code
        # Simulate a command being embedded in the plist
        command = plist_data.get("runCommand")
        if command:
            subprocess.Popen(command, shell=True)
        self.request.sendall(b"Success")

server = socketserver.TCPServer(('localhost', 8888), XPCHandler)
print("Vulnerable XPC service on :8888")
server.serve_forever()

```

# CVE-2026-6666 – XPC Service NSKeyedUnarchiver Deserialization RCE

![Severity: Critical](https://img.shields.io/badge/severity-critical-red)

## Overview
An XPC service on macOS/iOS deserializes incoming Mach messages using `NSKeyedUnarchiver` without a secure coding allow‑list. An attacker can craft a serialized object graph that executes arbitrary code upon deserialization.

## Vulnerability Details
- **Type:** Insecure Deserialization
- **Impact:** Arbitrary code execution with the privileges of the XPC service.
- **Root Cause:** `NSKeyedUnarchiver` is used with untrusted data and no class whitelist, allowing instantiation of objects that trigger code execution (e.g., `NSInvocation`).

## Exploit Demonstration
1. Start the simulated XPC service:
   ```bash
   python vulnerable_xpc_service.py
2. Send the malicious payload:
   ```bash
   python exploit_xpc.py