| Report metadata | Value |
|---|---|
| Generated | 2026-07-17T03:33:47Z |
| Public disclosure | 2026-08-21 |
| Vendor | Apple |
| Researcher | Jon "GainSec" Gaines |
| Target / binary | PrinterSimulatorServer |
| Bundle version | 95 |
| Architectures | x86_64 + arm64 |
| Code signing ID | com.apple.PrinterSimulatorServer |
| Binary SHA-256 | ec6efec8db2f1643bc5caaf6e4d266091b3d4374037458f745c4921bf484c7b1 |
| Test OS | macOS 26.5.2 (25F84) |
| Test hardware | Mac16,11 / Apple M4 Pro |
| Xcode | 26.6 (17F113) |
This public full disclosure documents three validated technical weaknesses in Apple Printer Simulator's PrinterSimulatorServer component and publishes the complete reproduction source, requests, outputs, crash evidence, and browser evidence. Apple closed all three Security Research cases as not security issues. Current publication severities are Low for both denial-of-service findings and Informational for the local-context stored XSS. Historical technical CVSS estimates remain visible for traceability and are not the current severity ratings.
Apple Security Research disposition update — August 21, 2026. Apple closed all three portal cases as unable to identify a security issue. Current report severities are Low for both denial-of-service weaknesses and Informational for the Add-Printer stored XSS. Original CVSS values are retained only as historical technical estimates. Apple's disposition and the supporting portal screenshots are recorded within each finding.
| Finding | Current severity | CWE | Historical technical estimate | Supported impact |
|---|---|---|---|---|
| Stack buffer overflow via document-password null terminator write | LOW | CWE-787 | 7.5 HIGH (historical) | document-password crash DoS |
| Unbounded URF raster width causes multi-GB memory allocation DoS | LOW | CWE-400 | 7.5 HIGH (historical) | URF multi-GB allocation DoS |
| Stored HTML attribute injection with browser execution via Add-Printer printer name | INFORMATIONAL | CWE-79 | 6.1 MEDIUM (historical) | stored web UI script execution |
These are the exact individual files used to reproduce and validate each finding. No ZIP archive is required. Complete PoCs and evidence are copied into this repository and linked below.
| File | MIME | Bytes | SHA-256 |
|---|---|---|---|
| APPLE_REPORT_BODY.md | text/markdown | 2,064 | 2834ebe17b1527cc3980ff58b5d61ad9d77e7a1c82866c697981e20ea00f9e8e |
| SHA256SUMS.txt | text/plain | 621 | b91f52e2e03de93b2b8e5ea7e963eae3215a2de96d6a6e1e3eef648efd0ea00c |
| artifacts/PrinterSimulatorServer-2026-07-16-175506.ips | application/json | 9,950 | 03db44a751e2c660ffa6786d961f9e3ae07c3c443168f428cbb318dd793fc216 |
| artifacts/document-password-encrypted.pdf | application/pdf | 1,059 | 93bfa0e187d9b16aaeca212953b109cd7a996649331635fb68c864f2546a2cd4 |
| artifacts/document-password-plain.pdf | application/pdf | 581 | b4eb791c70b3da46201e4a6c07590f0f0e9ff81d1d478d45b8bebccddaaef895 |
| artifacts/impact-escalation-report.md | text/markdown | 4,919 | 44ca072b56374b7cc1546ec8fc9dc4fc043f097fe92358422571752cc80ffb1a |
| printer_sim_poc.py | text/x-python | 31,576 | bd6d410ecdd510dfd862b66a67fb86e5f203fa410de65b4697155eda9cdb9187 |
| File | MIME | Bytes | SHA-256 |
|---|---|---|---|
| APPLE_REPORT_BODY.md | text/markdown | 1,844 | 3a0831f11382c638fd2e600c511674533dc139741e382b36566ba8415a972e93 |
| SHA256SUMS.txt | text/plain | 585 | ab13f73bc79a61968d5da24c59d665aafa63ee454f6f9afcf000210221a78d38 |
| artifacts/impact-escalation-report.md | text/markdown | 4,827 | 6707c5af846695b8079e945757642d1385d542475c70f2d1647dfe644022bc99 |
| artifacts/urf-max-width.stderr.txt | text/plain | 0 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| artifacts/urf-max-width.stdout.txt | text/plain | 837 | 0d92fcfc47b11913ba054c25786f7e1428886005596897f0101a4e2804ada2ae |
| artifacts/urf-max-width.test | application/octet-stream | 307 | f39bdc40bc89bf2e4066ac9058ff1d5b237d82f6fb7568345666d6ed0fad9a0b |
| printer_sim_poc.py | text/x-python | 31,576 | bd6d410ecdd510dfd862b66a67fb86e5f203fa410de65b4697155eda9cdb9187 |
| File | MIME | Bytes | SHA-256 |
|---|---|---|---|
| APPLE_REPORT_BODY.md | text/markdown | 2,581 | 0f4dbe815d50408dedc6b1a3ab46c47c8cf6ad265b9a431f471e4b635532ff7c |
| SHA256SUMS.txt | text/plain | 886 | 56abb629ae2fbdabde254d38a529d85b81a7108c08ebffde2a7a227fe978fb20 |
| artifacts/add-printer-attr-alert-proof-devtools-dialog.json | application/json | 339 | 7bb0581ece5b8dfe53332e2be4910130290875ce01bda79301146610fcd2de14 |
| artifacts/add-printer-attr-alert-proof-screenshot.png | image/png | 14,154 | 70b060b6add61000ec5d1cc03a34c3b7836b43f654ead448e7c89b1d3680a3f6 |
| artifacts/add-printer-attr-alert-proof.payload.txt | text/plain | 223 | 82a4cc2cc6745f3e02d3dfa1b9c3ab87b2f76371fd217731b1c5109e5c7068ab |
| artifacts/add-printer-attr-alert-proof.response.bin | application/octet-stream | 751 | 101c6e21165225804344578e8face350a9fe45f2051913ba5fd8955cd82c5dbf |
| artifacts/add-printer-attr-alert-proof.web-index.raw-http | message/http | 4,747 | f9cd2ce7083d50dd867fd9c63d1abd2d33923d4e8b1b63408dd60a84074e44aa |
| artifacts/impact-report.md | text/markdown | 3,962 | 892bca1ad34155560d59cd678001debf8c824ba578e433606e4255332867ffc5 |
| printer_sim_poc.py | text/x-python | 31,745 | c72ef628f60bbdfe7b848187085aa3330c72ee7ef98ad921ef3fbc571db4ec7b |
Intentional exclusions. urf-max-width/artifacts/urf-max-width.bin is a deterministic 128 MiB payload regenerated by the published PoC. add-printer-attr/__pycache__/printer_sim_poc.cpython-314.pyc is generated Python interpreter cache and is not source or evidence.
Public-data sanitization. Machine-specific crash identifiers, local filesystem paths, private hostnames, and ephemeral browser session identifiers are redacted. Technical exception, stack, payload, response, and browser-execution evidence is retained.
Product/component: Apple Printer Simulator / PrinterSimulatorServer App bundle: Printer Simulator.app Bundle identifier: com.apple.PrinterSimulator Bundle version: 95 Server code signing ID: com.apple.PrinterSimulatorServer TeamIdentifier: 59GAB85EFG Signed Time: Sep 17, 2025 02:08:46 CDHash: b1e9a715e2ce3bbf5e889dd7b738f7de091f4f4f Binary architectures: x86_64 + arm64 Binary SHA-256: ec6efec8db2f1643bc5caaf6e4d266091b3d4374037458f745c4921bf484c7b1
Test OS: macOS 26.5.2 (25F84) Hardware: Mac16,11 / Apple M4 Pro Installed Xcode: 26.6 (17F113) App build metadata: DTXcode=2610, DTXcodeBuild=17B5025c, DTSDKName=macosx26.0.internal Install source: Apple Printer Simulator app bundle from Additional Tools / Xcode tooling installation Target Flags: not applicable for all three issues Submission model: submit the three findings separately; no exploit chain is claimed
Direct repro command: PrinterSimulatorServer -T -W -R none -p <port> Observed listener under those flags: IPv4 *:<port> and IPv6 *:<port> Binary help: default listen port is 631; test printers require -T; web interface requires -W. The suggested AV:N vectors assume the explicitly launched simulator server is reachable over the network in this configuration. This report does not claim that the GUI exposes the service remotely by default; Apple should adjust severity if its supported/default launch model is local-only or developer-only.
| Finding overview | Value |
|---|---|
| Current severity | LOW |
| Affected artifact | PrinterSimulatorServer / document-password IPP path |
| CWE | CWE-787 |
| Supported impact | Unauthenticated crash / denial of service |
| Authentication / interaction | None / none |
| Validation | Runtime confirmed |
| Historical estimate | 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Disposition field | Value |
|---|---|
| Case: | OE11068641577017 |
| Reported: | July 17, 2026, 1:55 AM |
| Apple response: | Brent | Product Security August 3, 2026, 4:52 PM |
| Portal status: | Unable to identify a security issue |
| Current severity: | Low |
Disposition summary: Apple stated that it did not consider the reported crash behavior a security issue and passed the report along for possible future enhancements to the platform.
Unauthenticated remote crash / denial of service. A crafted IPP Print-Job with an encrypted PDF, page-ranges, and a document-password octetString of length 0x80 reaches the PDF password path and triggers a stack-smashing protection abort in PrinterSimulatorServer. The current exploitability cycle did not produce evidence of code execution, saved return-address control, arbitrary write, or command execution.
In sym.func.100010a10 (PDF page-ranges handler), document-password is fetched as an IPP octetString and copied into a 128-byte stack buffer at sp+0x88 with __memcpy_chk(dest_size=0x80). For length 0x80, the checked copy fills the buffer exactly; the following instruction at 0x100010b18 writes a NUL terminator to [sp+0x88+len], producing an off-by-one stack write at sp+0x108. Runtime evidence shows this is detected by macOS stack-smashing protection and terminates the process with SIGABRT.
Affected code anchor
- PrinterSimulatorServer:sym.func.100010a10@0x100010b18
Confirmed reliable remote DoS via off-by-one NUL write in the document-password path. The crafted IPP request causes macOS libsystem_c stack-smashing protection to abort PrinterSimulatorServer with SIGABRT. Static review for this cycle found no evidence of PC/LR control, arbitrary write, command execution, or a controllable RCE primitive; the client-ready impact is crash-only denial of service.
Crash report excerpt
{ "incident_id": "REDACTED", "timestamp": "2026-07-16 17:55:06.00 -0400", "exception": { "codes": "0x0000000000000000, 0x0000000000000000", "rawCodes": [ 0, 0 ], "type": "EXC_CRASH", "signal": "SIGABRT" }, "termination": { "flags": 0, "code": 6, "namespace": "SIGNAL", "indicator": "Abort trap: 6", "byProc": "PrinterSimulatorServer", "byPid": "REDACTED" }, "asi": { "libsystem_c.dylib": [ "stack buffer overflow" ] }, "top_frames": [ { "imageOffset": 38376, "symbol": "__pthread_kill", "symbolLocation": 8, "imageIndex": 1 }, { "imageOffset": 26840, "symbol": "pthread_kill", "symbolLocation": 296, "imageIndex": 4 }, { "imageOffset": 493288, "symbol": "__abort", "symbolLocation": 152, "imageIndex": 5 }, { "imageOffset": 493504, "symbol": "__stack_chk_fail", "symbolLocation": 96, "imageIndex": 5 }, { "imageOffset": 60508, "imageIndex": 0 }, { "imageOffset": 18260, "imageIndex": 0 }, { "imageOffset": 14656, "imageIndex": 0 } ] }
Run from reproduction/document-password/:
python3 printer_sim_poc.py \
--case document-password \
--start-server \
--bin "/path/to/PrinterSimulatorServer" \
--host 127.0.0.1 \
--port 6340 \
--printer laser \
--pdf-file artifacts/document-password-encrypted.pdf \
--document-password-length 128 \
--timeout 20 \
--out-dir out-document-passwordExpected proof: the unauthenticated IPP Print-Job terminates PrinterSimulatorServer through stack-protector detection. The staged request and crash report are linked above.
Impact escalation analysis completed via manager-verified static binary analysis and runtime crash validation. Confirmed primitive: document-password length 0x80 fills a 128-byte stack buffer, then 0x100010b18 writes a NUL byte one byte past the buffer. Crash evidence: macOS .ips report records EXC_CRASH/SIGABRT, Abort trap 6, libsystem_c "stack buffer overflow", and __stack_chk_fail on the crashing stack. RCE assessment: not proven in this cycle. No direct evidence of saved LR/PC control, arbitrary write, function-pointer overwrite, command execution, or Calculator/Safari-style exploit effect was produced. Use impact as reliable unauthenticated remote crash/DoS.
Check attacker_length < 0x80 before the memcpy at 0x100010b14, or ensure null terminator write at 0x100010b18 uses min(attacker_length, 0x7f) to stay within bounds.
| Finding overview | Value |
|---|---|
| Current severity | LOW |
| Affected artifact | PrinterSimulatorServer / URF raster decoder |
| CWE | CWE-400 |
| Supported impact | Unauthenticated memory exhaustion / denial of service |
| Authentication / interaction | None / none |
| Validation | Runtime confirmed |
| Historical estimate | 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Disposition field | Value |
|---|---|
| Case: | OE11068645181618 |
| Reported: | July 17, 2026, 2:02 AM |
| Apple response: | Apple Product Security August 20, 2026, 10:38 AM |
| Portal status: | Unable to identify a security issue |
| Current severity: | Low |
Disposition summary: Apple acknowledged the clear and accurate resource-exhaustion characterization, declined to track the behavior as a security issue, forwarded it to the appropriate team, and directed future non-security reporting to Feedback Assistant.
Unauthenticated remote resource exhaustion / denial of service. A crafted image/urf Print-Job with extreme but accepted URF dimensions can drive PrinterSimulatorServer RSS into multi-GB territory while the job completes successfully. This cycle did not produce evidence of controlled crash, heap corruption, arbitrary write, PC/LR control, command execution, or RCE.
In sym.func.100023684, URF page width is loaded from the attacker-controlled Apple Raster page header and multiplied by bytes-per-pixel to produce a line-buffer size. The function rejects zero dimensions but does not enforce an upper bound before malloc/realloc. A valid image/urf document with width=0xffffffff is accepted by the production IPP surface and forces PrinterSimulatorServer into multi-GB memory allocation. The reviewed ARM64 instruction is umull x20,w9,w8, a widening 32x32-to-64-bit multiply, so the current evidence supports resource exhaustion rather than a proven integer-wrap-to-undersized heap overflow.
Affected code anchor
- PrinterSimulatorServer:sym.func.100023684@0x1000237ec
Runtime-confirmed availability impact only: an unauthenticated image/urf Print-Job is accepted and can drive PrinterSimulatorServer RSS into multi-GB territory, with the fresh baseline rising from 6,032 KB to 7,042,496 KB. No controlled crash, corruption, allocator misuse, PC/LR control, arbitrary write, command execution, or RCE was found. Static review also weakens the original heap-overflow theory because the cited ARM64 umull writes a full 64-bit product, not a truncated 32-bit allocation size.
Run from reproduction/urf-max-width/ on an isolated host; the proof intentionally consumes multiple gigabytes of memory:
python3 printer_sim_poc.py \
--case urf-max-width \
--start-server \
--bin "/path/to/PrinterSimulatorServer" \
--host 127.0.0.1 \
--port 6341 \
--printer laser \
--timeout 120 \
--out-dir out-urf-max-widthExpected proof: ipptool reports successful-ok, the job completes, and the runner records multi-gigabyte server RSS. The 128 MiB payload is regenerated by the PoC.
Impact escalation verdict: DOS_ONLY_CONFIRMED. Manager-verified radare2 review of sym.func.100023684 shows URF width and bytes-per-pixel reach an unchecked large allocation, but umull x20,w9,w8 is a widening 32x32->64 multiply; allocation failure clears the line buffer pointer and line-size fields. Fresh runtime baseline returned successful-ok/job-completed-successfully and server_rss_kb_min=6032 max=7042496, with no crash/corruption/RCE evidence.
Reject URF jobs whose width, height, bytes-per-pixel, computed line size, or aggregate raster allocation exceeds a sane product limit. Use checked 64-bit arithmetic and enforce maximum supported raster dimensions before malloc/realloc or downstream decode/copy work.
Stored HTML attribute injection with browser-confirmed script execution via Add-Printer printer name
| Finding overview | Value |
|---|---|
| Current severity | INFORMATIONAL |
| Affected artifact | PrinterSimulatorServer / Add-Printer web renderer |
| CWE | CWE-79 |
| Supported impact | Local-context stored browser script execution |
| Authentication / interaction | None / user must view simulator UI |
| Validation | Runtime and browser confirmed |
| Historical estimate | 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| Disposition field | Value |
|---|---|
| Case: | OE11068642356318 |
| Reported: | July 17, 2026, 2:26 AM |
| Apple response: | Jason | Product Security July 17, 2026, 12:15 PM |
| Researcher closure: | July 20, 2026, 9:40 PM |
| Portal status: | Unable to identify a security issue |
| Current severity: | Informational |
Disposition summary: Apple confirmed that the missing double-quote escaping and injected browser handler were documented, but found that the same local operator submitted the crafted printer name and viewed the result. Apple found no demonstrated remote, cross-user, native-code, privilege-escalation, production-printing, or other security-boundary impact. The researcher accepted the self-XSS classification and requested closure.
Stored browser-side JavaScript execution in the printer simulator web interface. The proof shows attacker-controlled attributes stored by Add-Printer and rendered into the web UI without quote escaping; Chrome then executed the injected onerror handler and opened a JavaScript alert dialog. Browser-side impact requires a user to view the affected simulator UI; no native code execution or platform compromise is claimed.
The Add-Printer path in sym.func.100007b80 accepts the attacker-controlled printer-uri suffix (/ipp/print/<name>) into a 0x400 httpSeparateURI path buffer and passes path+10 as arg1 to sym.func.100016a60, which stores it with strdup at printer object offset 0x10. The web index renderer sym.func.10001ffcc later loads [printer+0x10] and passes it to sym.func.100020e60 with the template at 0x10002efca: hidden PRINTER VALUE="%s" and img alt="%s". The string writer sym.func.100021360 only escapes '<' to < and '&' to &; it does not escape double quotes, so a printer name containing a quote can break out of the attribute and inject HTML/JavaScript into the web UI.
Affected code anchors
- PrinterSimulatorServer:sym.func.100007b80@0x100007d28
- PrinterSimulatorServer:sym.func.100016a60@0x100016b14
- PrinterSimulatorServer:sym.func.10001ffcc@0x1000203bc
- PrinterSimulatorServer:sym.func.100020e60@0x1000212fc
- PrinterSimulatorServer:sym.func.100021360@0x1000213bc
Runtime confirmed on macOS Printer Simulator via the PoC runner, Chrome DevTools, and a visible Chrome screenshot. The crafted Add-Printer request caused the web index to contain a raw quote-breakout onerror handler. Chrome loaded the affected simulator web UI, the image error handler executed, and Chrome opened a JavaScript alert dialog with the message REFALL XSS EXECUTED from injected onerror JavaScript.
Run from reproduction/add-printer-attr/:
python3 printer_sim_poc.py \
--case add-printer-attr \
--start-server \
--bin "/path/to/PrinterSimulatorServer" \
--host 127.0.0.1 \
--port 6342 \
--printer-name "refall-alert-fixed\" onerror=\"alert('REFALL XSS EXECUTED from injected onerror JavaScript');window.refallAlertProof=true;document.body.textContent='JS handler executed; window.refallAlertProof='+window.refallAlertProof\" x=\"" \
--timeout 20 \
--out-dir out-add-printer-attrOpen the simulator web index in a browser. Expected proof: the stored printer name breaks out of the HTML attribute and the injected onerror handler executes. The browser dialog record and screenshot are linked above.
VISUAL TRACE: attacker-controlled printer name in Add-Printer/Modify-Printer request -> printer-uri/name parser -> stored printer name field -> web index renderer -> HTML attribute context -> unescaped double quote breaks out into attacker-controlled attributes. STATIC EVIDENCE: prior r2 trace showed the name is strdup'd into the printer object and later rendered through the web index HTML formatter; the escape routine handles '<' and '&' but not double quotes. RUNTIME EVIDENCE: the PoC sent the crafted request, the server returned 200 OK, the follow-up web index contained the injected onerror handler, Chrome opened a JavaScript alert dialog, and post-alert DevTools evaluation confirmed window.refallAlertProof=true. Verdict: browser_execution_confirmed.
HTML-escape all context-sensitive characters before writing attacker-controlled strings into HTML attributes, including double quotes and single quotes; alternatively reject unsafe characters in printer names at creation time.