# Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529

Type confusion in coreaudiod's audiohald Mach service allows hijacking control flow via uninitialized ngne object and heap spray, achieving code execution.

- Payout: Research
- Severity: high
- Program: macOS coreaudiod
- Credited: Dillon Franke, Google Information Security Engineering, 20% time on Project Zero
- Disclosed: 2026-01-30
- CVE: CVE-2024-54529
- Write-up quality: 9/10
- Original: https://projectzero.google/2026/01/sound-barrier-2.html
- Library page: https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-01-sound-barrier-2-html
- Tags: domain:desktop impact:privesc impact:rce kind:research platform:research sev:high technique:chained technique:source-review vuln:memory-corruption vuln:privilege-escalation

**Target:** coreaudiod Mach service (com.apple.audio.audiohald)
**Root cause:** Mach message handlers fetch HALS_Object by ID and assume it is of type ioct without validation, leading to type confusion when a different object type is used.
**Steps:**
1. Send Mach message to coreaudiod invoking HALS_Object_SetPropertyData_DPList with a large plist containing controlled data (e.g., arrays of CFString/CFData) to spray heap and store plist to disk.
2. Trigger the type confusion via _XIOContext_Fetch_Workgroup_Port to crash coreaudiod.
3. Wait for coreaudiod to restart, load the plist from disk, allocate and free it, then allocate an ngne object over the freed memory.
4. Trigger the type confusion again on an ngne object; if the uninitialized 6 bytes at offset 0x68 point to controlled data, control flow is hijacked.
5. Use ROP chain encoded in CFString (UTF-16) to call open() and write a file, achieving arbitrary code execution.
**How found:** Knowledge-driven fuzzing of coreaudiod Mach services revealed type confusion; exploitation involved analyzing heap layout with custom object dumper, discovering uninitialized memory in ngne objects via Guard Malloc PreScribble, and leveraging plist serialization for heap spray.
**Exploitation:** Heap spray with plist to control memory, crash to force restart and reuse freed plist memory for ngne object, then trigger type confusion to pivot stack to ROP chain and execute syscalls.
**Escalation:** Chained uninitialized memory in ngne object with heap spray and process restart to bypass malloc zeroing, leading to ROP and code execution.
**Insight:** When malloc zones zero memory, look for objects allocated in non-zeroed zones (e.g., malloc_small) and use process restart to reallocate attacker-controlled data from disk-persisted plists.