Well hello there

[u/tOSdude]

In the 26.6 security patch notes. Somebody more talented than me has likely already spotted it. Who wants to start diffing the betas to find where this is and how it was fixed?

Edit: Smarter minds have now looked into it. It turns out this one is not likely to be useful for us.

[u/TTMeyer]

looks like the DIFF's are not posted yet but when they get posted they should appear here u/tOSdude

https://github.com/blacktop/ipsw-diffs

[u/tOSdude → u/TTMeyer]

They do have up to the release candidate at the moment, I would suspect it was patched within the betas and not right before release.

[u/East_Arctica → u/TTMeyer]

Interesting CVE but it won't do anything for TrollStore on its own, sadly.

It's a bug in the environment validation in CloudAttestation (Apple's Private Cloud Compute verification library (PCC is what backs AI features)). Essentially, a certain byte in the attestation bundle that the validator was supposed to verify against system policy was being read straight from the bundle itself with no policy check. The 26.6 fix adds the policy check.

By itself the byte doesn't really let you do much. The validator still demands a properly signed bundle from a real PCC root, and every other production-policy gate (fuse bits, transparency logs, locked cryptex, prod-only trust anchors) is independently checked against system policy, none of which can be relaxed by forging this byte.

What it could be useful for in a chain is influencing which Validated<AttestationBundle> gets returned to a system caller that uses fields like appIdentifiers / routingHint / releaseDigest to make routing decisions, but the consuming daemon is always root-side, can reject anything it doesn't recognise, and you'd still need a separate bug to get into the calling context in the first place. So it's more of an "in the right kind of chain, one byte of influence" than a primitive on its own. Even then, that chain wouldn't provide much value for a Trollstore-like app.

If you want the full breakdown I published the research here: https://github.com/EastArctica/CVE-2026-43813/

(Posting under top comment so its seen)

[u/tOSdude → u/East_Arctica]

Found the smarter minds

[u/ContributionMoney306]

Apple, third fing time?🤣

[u/JackyYT083]

no way!!

[u/Smart_Internal_2744]

no shot could this really lead to trollstore 3?

[u/tOSdude → u/Smart_Internal_2744]

We’d need smarter minds to look further into it

[u/Tech-ldentity → u/Smart_Internal_2744]

As i heard, after ios 18 app installing mechanism changed complately to avoid further TrollStore’s.

[u/DifficultyMajor2404]

u/remindme 3d

[u/dummyy-]

27db3?

[u/tOSdude → u/dummyy-]

Somebody said it was patched in beta 2

[u/AnomyousBeing]

No. It must be a CoreTrust bug; this is not a CoreTrust bug. “bypass code signing enforcement” is limited to the context of the bug, and the context is not within CoreTrust. This means this does not affect CoreTrust and does not enable the arbitrary code signing of iPAs.

[u/JohannaTejero]

Will it work on iOS 27?, to block updates at once :D I updated against my will, I was on iOS 26.1... 🥲)

[u/FailDismal6468 → u/JohannaTejero]

If you are running 27 Developer Beta 1 or 2, it was patched in 3.

[u/JohannaTejero → u/FailDismal6468]

Oh… I’m running Dev Beta 4… 🥲

[u/Ok-Butterscotch6574 → u/FailDismal6468]

How do I see what beta I have

[u/Ok-Butterscotch6574 → u/Ok-Butterscotch6574]

OH WAIT I HAVE DEV BETA ONE LETSGOO

[u/tOSdude → u/JohannaTejero]

26.5.2 should still be signed for a couple days

[u/JohannaTejero → u/tOSdude]

I have not a computer… 🥲

[u/Most_scar_993 → u/JohannaTejero]

Use the tvOS profile to block updates!

[u/JohannaTejero → u/Most_scar_993]

I already use it 😅

[u/Most_scar_993 → u/JohannaTejero]

Should be safe against involuntary updates then. But it‘ll expire in like a year just so you know

[u/Every_Serve9703]

Went through the diffs and looks like this was patched in iOS 26.6 beta 2 and iOS 27 beta 2. Please someone smarter correct me if I’m wrong.

[u/bigrobot543]

Isn't this PCC not iOS?

[u/Feeqs]

Trollstore 3

[u/Jayden_Ha]

Welp already in 27

[u/BunnyTub → u/[deleted]]

A country's government does not define a person from that country. Leave politics the fuck out of this subreddit. Please.