Research
Explore vulnerabilities discovered by Beryllium researchers, their impact, and the public records behind each finding.
Credited vulnerabilities
3 CVEs. Publicly documented.
Each entry links to Apple's security advisory and the corresponding public vulnerability record.
CVE-2026-43681
AppleRAID
macOS Sonoma, Sequoia, and Tahoe
A local user may be able to read kernel memory
A buffer overflow was addressed with improved bounds checking.
CVE-2026-28976
UserAccountUpdater
macOS Tahoe
An app may be able to gain root privileges
An information leakage was addressed with additional validation.
CVE-2026-39869
Audio
macOS Tahoe
Processing an audio stream in a maliciously crafted media file may terminate the process
The issue was addressed with improved memory handling.
Technical write-ups
Go inside the findings.
Read how the vulnerabilities were found, validated, and responsibly reported.
How I Discovered CVE-2026-43681: An AppleRAID Kernel Heap Overflow in macOS
An unchecked index from AppleRAID disk metadata crossed a kernel heap allocation boundary. Live tracing confirmed the out-of-bounds pointer write, and Apple fixed the issue in macOS Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6.
Read the research
How I Discovered CVE-2026-28976: A macOS Login Password Leak in the loginwindow–UserAccountUpdater Handoff
A macOS login flow exposed a live LocalAuthentication context that let an ordinary same-user process recover the real account password. Apple fixed the issue in macOS Tahoe 26.5.
Read the research