CVE-2026-65343

CVE-2026-65343 is a proof-of-concept exploit for an out-of-bounds read vulnerability in the AppleKeyStore kernel extension, specifically in the `_LibSer_SEPControl_Deserialize` function, which allows a sandboxed process to leak kernel pointers and compute the Kernel Address Space Layout Randomization (KASLR) slide. The tool exploits improper validation of length during message deserialization to capture and manipulate a real ACM session handle to reveal sensitive kernel information. Notable features include the in-process capture of authentication handles and the use of dyld interpose for circumventing standard sandbox protections.