Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529
Brief
In the first part of this series , I detailed my journey into macOS security research, which led to the discovery of a type confusion vulnerability ( CVE-2024-54529 ) and a double-free vulnerability ( CVE-2025-31235 ) in the coreaudiod system daemon through a process I call knowledge-driven fuzzing .
While the first post focused on the process of finding the vulnerabilities, this post dives into the intricate process of exploiting the type confusion vulnerability.
I’ll explain the technical details of turning a potentially exploitable crash into a working exploit: a journey filled with dead ends, creative problem solving, and ultimately, success.
The Vulnerability: A Quick Recap
If you haven’t already, I highly recommend reading my detailed writeup on this vulnerability before proceeding.
As a refresher, CVE-2024-54529 is a type confusion vulnerability within the com. apple. audio.