CVE-2007-0236: Double free vulnerability in the _ATPsndrsp function in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to cause a denial of…

PriorityP352critical10CVSS 2.0

AVNACLAuNCCICAC

EXPLOIT

EPSS

21.30%

97.3th percentile

Double free vulnerability in the _ATPsndrsp function in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to cause a denial of service (kernel panic) and possibly execute arbitrary code via a crafted AppleTalk request that triggers a heap-based buffer overflow.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
apple	mac_os_x	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Exploit triggers kernel panic via crafted AppleTalk request using ATPsndrsp() with a heap buffer overflow; monitor for abnormal AF_APPLETALK SOCK_RAW socket creation followed by repeated ATPsndrsp() calls with large/malformed buffer sizes ↗
→PoC fills a 6000-byte buffer with 0x41 ('A') bytes and iterates 7000 times calling ATPsndrsp() with varying length parameters — detect repeated AppleTalk syscalls with large or decrementing buffer length arguments as a sign of exploitation attempt ↗
→Vulnerability is a double free in _ATPsndrsp triggered by a crafted AppleTalk request; kernel panic is the observable outcome — monitor macOS kernel logs for panics referencing _ATPsndrsp or AppleTalk heap corruption ↗

·The exploit requires AppleTalk to be enabled on the target system; the PoC itself notes execution will not reach the free() call unless AppleTalk is disabled, meaning the attack surface is limited to systems with AppleTalk active ↗
·Affected version is confirmed as Apple Mac OS X 10.4.8; 'possibly other versions' are noted but unconfirmed ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.