Unpatchable ‘usbliter8’ Exploit Breaks Apple A12 and A13 SecureROM Boot Chain

Security researchers at Paradigm Shift have published a working exploit, dubbed usbliter8, that achieves arbitrary code execution inside the SecureROM of Apple’s A12 and A13 chips. The SecureROM is burned into the silicon at manufacture, meaning no software update can patch it. Affected devices will carry this flaw for as long as they stay in use.

This is not a remote attack. It requires physical possession of the device, which must be in DFU mode and connected via USB to a dedicated RP2350-based microcontroller board. With that setup, the exploit finishes in under two seconds, before Apple’s signed boot chain loads. The full technical write-up and a working proof of concept went public on June 18, 2026, following coordinated disclosure with Apple Product Security.

The root issue is a hardware flaw in the Synopsys DWC2 USB controller. The controller stores incoming USB Setup packets via DMA, buffers up to three, then resets its write pointer on the fourth by decrementing it by a fixed 24 bytes. It also accepts smaller-than-standard packets, incrementing the pointer only by the actual bytes written. That mismatch accumulates into a repeatable buffer underflow, stepping the write pointer backwards through memory 12 bytes at a time. On A12 and A13, Apple configures the USB DART (Device Address Resolution Table, the chip’s IOMMU) in bypass mode inside SecureROM, so the underflowing DMA pointer can reach and overwrite arbitrary SRAM. A11 is not affected because its USB driver manually resets the DMA address after every packet. A14 and later configure DART correctly, making the vulnerability unexploitable on newer hardware.

Post-exploitation, usbliter8 injects a custom USB request handler and stamps PWND:[usbliter8] into the device’s USB serial string. From there, an attacker can temporarily demote the SoC’s production mode or boot a raw, unsigned iBoot image with no signature checks, stepping outside Apple’s chain of trust entirely. The research does not show a Secure Enclave compromise. Paradigm Shift warns that BootROM-level control may open new routes for attacking it.

As of June 19, 2026, no CVE, CVSS score, Apple security advisory, or CISA alert had been issued, and no in-the-wild exploitation had been publicly reported. For most users, the practical risk is low: an attacker needs the physical device, the right cable, and the knowledge to force DFU mode. For high-security environments, this is now a hardware-retirement and device-custody problem.