AirDrop V2 Deeply Nested XML Plist Stack Overflow in sharingd

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects macOS 'sharingd' or 'Foundation' service crashes (stack overflow, recursion limit exceeded, or EXC_BAD_ACCESS) that occur during the processing of plist files. This behavior is indicative of potential memory corruption exploits targeting vulnerabilities in Apple's plist parsing logic, potentially exploited via AirDrop.