# From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS

screensharingd's SRP frame-length validator returns stale success, letting unauthenticated attackers bypass auth and read/write arbitrary files as root via SSFileCopySender.

- Payout: Research
- Severity: critical
- Program: macOS Screen Sharing
- Credited: Huntress
- Disclosed: 2026-08-07
- CVE: CVE-2026-65400, CVE-2026-43760
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/macos-screen-sharing-rce-patched
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-macos-screen-sharing-rce-patched
- Tags: domain:network impact:data-leak impact:privesc impact:rce kind:research platform:threat-intel sev:critical technique:incomplete-fix technique:reverse-engineering vuln:auth-bypass vuln:info-disclosure vuln:rce

**Target:** screensharingd daemon / RFB (VNC) service on macOS
**Root cause:** The SRP frame-length validator in screensharingd erroneously returns a stale success status, so the connection is treated as authenticated; the session then continues without cryptographic protection (cleartext).
**Steps:**
1. Identify a host running Screen Sharing (screensharingd) on macOS ≤26.5.2 / ≤15.7.7 / ≤14.8.7.
2. Connect to the RFB service and drive the SRP auth exchange with a malformed frame length that triggers the stale-success return.
3. Observe the daemon treats the connection as authenticated and continues in cleartext (authentication_type: SRP, not RSA-SRP).
4. Use the file operations handled by SSFileCopySender (which holds kTCCServiceSystemPolicyAllFiles) to read/write arbitrary filesystem artifacts as root.
5. For RCE: write a LaunchDaemon or modify .zshenv; crontab path only works with SIP disabled.
**How found:** fG! noticed Apple's July patch inadvertently disturbed a pre-auth frame-length bug path and published an obfuscated read-only PoC; bl4sty reversed it, recovered the wire format, and traced the bypass to the SRP frame-length validator.
**Exploitation:** Pre-auth attacker connects to exposed Screen Sharing, abuses the SRP frame-length validator to be treated as authenticated root, then leverages SSFileCopySender's Full Disk Access entitlement to read/write any file, escalating to RCE via LaunchDaemon or shell startup file persistence.
**Escalation:** Read/write primitive chained to RCE via LaunchDaemon creation or .zshenv modification; crontab variant scoped to SIP-disabled systems.
**Insight:** When a vendor patch 'incidentally' changes behavior near an auth path, diff the pre/post behavior of length/state validators — a stale success return in a frame-length check can silently mark a session authenticated, especially when the session then skips crypto.