Pointer leaks through pointer-keyed data structures

This write-up describes a novel serialization-based information-leak on macOS: by crafting attacker-controlled plists that deserialize into NSDictionary instances with controlled NSNumber keys and an NSNull singleton key, an attacker can infer bucket positions during re-serialization and recover the shared-cache address of the CFNull singleton. The author provides a proof-of-concept, the mathematical method to reconstruct the full pointer from modulo leaks across multiple prime-sized hash tables, reproduction steps, and notes the issue was fixed in Apple’s 31 Mar 2025 security release; the attack is presented as theoretical with limited real-world evidence.