Independent lab · Nuremberg, Germany
Independent security research on operating system kernels.
NULLRING Research is the independent lab of Marco Schmitt. The focus is vulnerability research and reverse engineering of kernels, drivers and privileged system software, mainly on Apple platforms.
01
Research
The layer beneath applications.
The work concentrates on the layer beneath applications: kernels, drivers, system services and the mechanisms that protect them. The main focus is the security of Apple platforms. Other low-level targets such as hypervisors, firmware and other operating system kernels are added where they sustain a research topic.
NULLRING Research is not affiliated with Apple Inc.
02
CVEs
Reported, fixed, published.
Vulnerabilities I reported to Apple that have been fixed and publicly credited.
| CVE | Component | Impact | Fixed in |
|---|---|---|---|
| CVE-2026-84496 | APFS | Out-of-bounds write. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory. | macOS 27.2 |
| CVE-2026-112705 | AVEVideoEncoder | Out-of-bounds write. An app may be able to cause unexpected system termination. | macOS 27.2 |
| CVE-2026-112475 | HFS | Out-of-bounds read. An app may be able to cause unexpected system termination. | macOS 27.2 |
| CVE-2026-112478 | IOKit | Out-of-bounds read. An app may be able to cause unexpected system termination or read kernel memory. | macOS 27.2 |
All four are credited on Apple’s advisory for macOS Golden Gate 27.2 (APPLE-SA-149521, released 26 October 2026). Apple names several researchers per entry; the impact and description wording above is Apple’s own.
03
Blog
Analyses and method.
Technical analyses and write-ups of vulnerabilities I found and of the methods behind them.
- No articles yet.
04
Contact
Email is enough. Encrypted is welcome.
- marco.schmitt@sayanetworks.eu
- PGP
- pgp.asc · ed25519 · expires 2029-10-26 90FA A045 5E2D E540 C7CC 4E9B E8D9 FFA0 CAA9 EEEA
Email is the intended way to reach me; I answer promptly. If you found a vulnerability in something I publish, the same route is given machine-readably in /.well-known/security.txt (RFC 9116).