CVE-2018-4109: Overwriting kernel memory with a few video packets

This write-up documents CVE-2018-4109: a kernel-level buffer-overflow primitive stemming from an IOSurface plane offset sign mismatch and a tile-decoding flaw in AppleD5500.kext (video decoder). The researcher shows how carefully crafted video bitstreams and use of mediaserverd allow a sandboxed app to trigger a memset-based overwrite (controlling offset and length), enabling powerful kernel memory corruption; the issue was responsibly disclosed to Apple and patched in January 2018.