Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529 In the first part of this series, I detailed my journey into macOS security research, which led to the discovery of a type confusion vulnerability (CVE-2024-54529) and a double-free vulnerability (CVE-2025-31235) in the coreaudiod system daemon through a process I call knowledge-driven fuzzing. While the first post focused on the process of finding the vulnerabilities, this post dives into the intricate process o…

https://projectzero.google/2026/01/sound-barrier-2.html

sha256:d9f9b5798b94544f81bcd8c07ef39490eefd733866a3b3fd5d2546c31366b4bb

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve2
md50
url0
ipv40
ipv60
sha10
domain5
sha2560
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	com.apple.audio.audiohald	Open →
domain	com.apple.audio.system	Open →
domain	libdispatch.dylib	Open →
domain	com.apple.audio.devicesettings.plist	Open →
domain	malicious.txt	Open →
cve	CVE-2024-54529	Open →
cve

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports