The Most Dangerous Codec in the World: Finding and Exploiting Vulnerabilities in H.264 Decoders
summary
H26Forge is a toolkit that programmatically mutates H.264 syntax elements (30,000+ lines of Rust, Python transforms) to generate test videos; batches of 100 mutated files reveal bugs across players, kernel drivers and hardware. A concrete finding is CVE‑2022‑32939: the Apple d5500 kext mishandles emulation‑prevention bytes, allowing a 257/258 index sequence to produce a kernel‑controlled heap write via a 257/258 EPB overwrite, triggerable by thumbnailing (zero‑click) but requiring an information leak to fully exploit.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 3:32Video decoding attack surface
- 6:42H.264 codec complexity
- 14:29Introducing h26 Forge
- 16:36CVE 2022-32939 iOS heap write
- 23:02Security risks and future directions
- 25:50Conclusion and Q&A
related talks
12mHaving H26Fun with H26Forge: Vulnerability Hunting, Datamoshing, and More!
39mCache the Frames, Catch the Vulnerabilities in Kernel Streaming
51mExploiting Hardware Glitches And Side Channels In Perfect Software
43mDebug for Bug: Crack and Hack Apple Core by Itself
01h 16mClassic Vulnerabilities
01h 05mClassic Vulnerabilities
55mHow hacking works
53mResearching New Attack Interfaces On iOS And OSX