I found a possible mitigation for unpatched or unwatchable (older) systems, that leaves Screen Sharing operable! Two conditions must be met:
1. Activate screensharingd in Sharing by "Remote Management" instead of "Screen Sharing"
2. Allow Access for "Only these users" instead of "All users"
Since you built PoCs for both Pre-Auth bugs, could you please confirm whether this mitigation actually works? I only did limited testing using the NaviTheClown binary, which exploits the Frame Length.
To me it seems the first to publicly describe the later Pre-Auth bug (Zero-Key, CVE-2026-65400) was @bl4sty in his blog post on August 1st. But judging from only 5 days between his (seemingly independent) find and Apple's 26.6.1 fix, as well as according to the CVE credit it seems Alfredo Pesoli found and reported it earlier.
What we don't know for sure is, who reported the first Pre-Auth bug (Frame Length) to Apple? Most probably it's part of another one of the 4 (not 3) fixes to Screen Sharing in 26.6: the DoS with CVE-2026-43777 credited to Chapoly1305. He describes the correct bug, but doesn't seem to have noticed its further potential for File-Copy operations apart from DoS.
When you diffed 26.5.2→26.6 to find osxreverser's bug, is that what led you straight to the second bug too, since they're both exit points in the same broken auth state machine?
More important:
I found a possible mitigation for unpatched or unwatchable (older) systems, that leaves Screen Sharing operable! Two conditions must be met:
1. Activate screensharingd in Sharing by "Remote Management" instead of "Screen Sharing"
2. Allow Access for "Only these users" instead of "All users"
Since you built PoCs for both Pre-Auth bugs, could you please confirm whether this mitigation actually works? I only did limited testing using the NaviTheClown binary, which exploits the Frame Length.
Some additions and corrections:
To me it seems the first to publicly describe the later Pre-Auth bug (Zero-Key, CVE-2026-65400) was @bl4sty in his blog post on August 1st. But judging from only 5 days between his (seemingly independent) find and Apple's 26.6.1 fix, as well as according to the CVE credit it seems Alfredo Pesoli found and reported it earlier.
What we don't know for sure is, who reported the first Pre-Auth bug (Frame Length) to Apple? Most probably it's part of another one of the 4 (not 3) fixes to Screen Sharing in 26.6: the DoS with CVE-2026-43777 credited to Chapoly1305. He describes the correct bug, but doesn't seem to have noticed its further potential for File-Copy operations apart from DoS.
When you diffed 26.5.2→26.6 to find osxreverser's bug, is that what led you straight to the second bug too, since they're both exit points in the same broken auth state machine?