A critical path traversal vulnerability in Apple’s Private Cloud Compute (PCC), the server-side infrastructure powering Apple Intelligence.
Tracked as CVE-2026-20685, the flaw earned a $150,000 bounty under the Apple Security Bounty program and was patched in PCC releases 5E290.3 and later.
PCC handles Apple Intelligence requests that are too complex for on-device processing, promising iPhone-level privacy in the cloud through three guarantees.
Apple Private Cloud Compute Flaw
Statelessness (no data is retained across sessions), cryptographic attestation (devices verify that nodes run only Apple-published software), and sealed observability (only pre-approved telemetry leaves a node).
The vulnerability struck at the boot process itself before these protections fully engage. The flaw lives in darwin-init, the root-privileged PID 1 process that provisions PCC nodes at boot by downloading and installing signed software bundles called cryptexes.
When darwin-init encounters an archive that doesn’t match known magic bytes (AEA1 for Apple Encrypted Archive, AA01 for Apple Archive), it falls back to a generic extract(to:) function.
Critically, that function takes filenames directly from the archive entries and appends them to the output path without sanitization, and none of libarchive’s security flags were enabled to block traversal.
Because tar archives’ identifying signature sits at byte offset 257 beyond the four-byte check, a malicious tar file bypasses proper extractor selection entirely and lands in the vulnerable path.
Drinor discovered that a pure path-traversal payload would fail post-extraction integrity checks and hang the boot process.
The solution: a single tar archive combining traversal entries (using ../../../../db/ to escape into the persistent /var/db/ data volume) with a legitimate, validly-signed cryptex bundle.
This allowed malicious files to write to disk as root, while the node still passed validation and completed its userspace reboot cleanly.
Beyond a proof-of-concept file write, the exploit redirected splunkloggingd, PCC’s internal log forwarder, to an attacker-controlled server by overwriting its configuration file.
This exposed roughly 785 KB of CloudBoard daemon telemetry, per-inference-request metadata (including request IDs and device group identifiers explicitly marked “must not be logged publicly”).
Side-channel data like token counts and speculative-decoding timing information Apple’s own attestation framework never flagged as anomalous, since attestation measures installed software, not writable-volume state.
Drinor conducted all testing exclusively within Apple’s Virtual Research Environment, without touching production infrastructure. Apple rated the issue as information disclosure (CVSS 6.5) and validated the report through responsible disclosure.
The finding underscores a decades-old lesson: this is fundamentally the same vulnerability class as Zip Slip and CVE-2007-4559 (CWE-22), proving that securing an AI inference pipeline’s infrastructure is just as critical as securing the models themselves, especially as Apple expands PCC’s role ahead of the more capable Siri AI rollout later in 2026.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
, the server-side infrastructure powering Apple Intelligence.){kind=link}