Licht

Tinkering with iOS · Swift

I make small apps and tools, mostly for iOS, with an interest in Apple platform security.

Security

Vulnerabilities I reported to Apple that have been fixed.

CVE-2026-112454 Duplicate
AppleAVD — Processing a crafted video file could crash an app or corrupt process memory. Fixed with improved memory handling.
Shared credit with Hcamael and 章鱼哥@aipy

iOS / iPadOS 27.2 · macOS Golden Gate 27.2 · tvOS 27.2 · watchOS 27.2 · visionOS 27.2 · Oct 2026
CVE-2026-112691
SwiftUI — An out-of-bounds write that could let an app cause unexpected system termination. Fixed with improved input validation.
iOS / iPadOS 27.2 · iOS / iPadOS 26.7.2 · watchOS 27.2 · visionOS 27.2 · Oct 2026

Read the write-up →

Writing

Reaching RenderBox from an ordinary widget

How a normally signed third-party widget places a controlled heap overwrite inside Apple's system widget renderer, and where the allocator and PAC stop the escalation.

CVE-2026-112691iOSRenderBoxNov 2026

Projects

Airlift Cards

A macOS app that replaces and restores Apple Pay card artwork on a paired iPhone using images or PDFs.

macOSPythonApple PayMIT

CapsuleToast

A SwiftUI capsule toast that drops in from the top of the screen, dismissed by tap or swipe. Uses Liquid Glass on iOS 26.

SwiftUIiOS 17+Swift PackageMIT