Research Reveals How Pointer Ordering Can Leak Memory Addresses in Apple Software

Security researchers at Google's Project Zero have published details of a technique that could, in specific circumstances, leak memory address information from Apple devices without exploiting a traditional memory safety bug or using timing attacks. The method relies on systems that take in attacker-supplied data, convert it into internal objects, and then send that data back out again in a re-serialised form. Under the right conditions, the order in which pointers appear in these structures can reveal information that would normally help defeat a security protection called ASLR (Address Space Layout Randomisation), which is designed to make it harder for attackers to predict where code and data sit in memory.

The researchers were unable to identify a real-world attack surface on macOS or iOS where this specific weakness could be exploited, and instead demonstrated the concept using an artificial test case built around Apple's NSKeyedArchiver serialisation system. Because no confirmed real-world impact was found, the issue was reported to Apple informally rather than as a numbered bug, and Apple fixed it in security updates released on 31 March 2025.

While this issue was theoretical rather than actively exploited, it highlights how subtle design choices in software that handles serialisation and deserialisation of data can create unexpected security weaknesses, even without classic memory corruption bugs.

Key Takeaway: Australian small businesses using Apple devices should ensure all systems are kept updated with the latest security releases, since patches often close subtle vulnerabilities before they can be weaponised.