CVE-2026-49269: Apple M1 GPU Register Data Leakage – Cryptographic Secret Recovery

Technical summary

This vulnerability exploits incomplete register-file isolation in Apple M1 GPU compute units. When a Metal compute shader dispatch completes, residual data in GPU registers persists across process boundaries. A malicious or compromised sandboxed app can craft a GPU reader shader that retrieves stale register state from a prior victim dispatch. The proof of concept demonstrates a 128-bit secret generated via SecRandomCopyBytes in one app being fully recovered from GPU registers by a separate attacker app, bypassing the GPU sandbox's intended data isolation. Apple has confirmed the issue is resolved in current-generation Apple Silicon hardware.

Business impact

Organizations relying on M1-based Macs for sensitive GPU-accelerated cryptographic operations face a material confidentiality breach. Cryptographic keys, authentication tokens, or other secrets processed in GPU memory can be extracted by any untrusted app that gains code execution in the user's sandbox. This is particularly concerning in zero-trust or high-security environments where GPU acceleration is used for encryption, key derivation, or secure compute tasks. The risk is highest for deployments unable to immediately migrate from M1 to newer Apple Silicon.

Affected systems

Apple M1 GPU-equipped systems are vulnerable. This includes M1 Mac minis, MacBook Pro (13-inch, M1), MacBook Air M1, iMac 24-inch M1, and Mac Studio (original). Systems with M1 Pro, M1 Max, M1 Ultra, or newer generation Apple Silicon (M2 and later) are not affected; Apple has confirmed hardware-level fixes are present in current chips. The vulnerability requires an attacker to execute a sandboxed app on the target device.

Exploitability

Exploitation requires two factors: (1) the attacker must run a sandboxed Metal app on the target M1 system, and (2) a victim app must have processed sensitive data on the GPU prior to the attacker's shader dispatch. No user interaction is required beyond installing the attacker app. The attack is deterministic—once the attacker app runs, recovery of GPU register contents is reliable. However, the window of exposure depends on GPU scheduling and when the victim dispatch executes relative to the attacker's read shader. The CVSS score of 8.6 (HIGH) reflects the network and sandboxing context; local execution and sandbox escape are not required, but the attacker must have some local presence on the device.

Remediation

The definitive remedy is hardware replacement: migrate M1-equipped systems to M2-generation or newer Apple Silicon. Apple has confirmed fixes are present at the hardware level in current chips. For M1 systems that cannot be immediately replaced, security teams should: (1) disable GPU acceleration for cryptographic workloads if feasible, (2) implement runtime detection of suspicious Metal shader activity, and (3) enforce strict app-installation policies to reduce the likelihood of untrusted code execution. No firmware update addresses this on M1 hardware.

Patch guidance

No firmware patch is available for M1 systems; the vulnerability is unfixable in hardware. Organizations must evaluate their M1 fleet and plan a phased migration to M2 or newer Apple Silicon. For new device procurement, specify M2-generation or later to avoid this issue. If M1 systems must remain in service, apply compensating controls at the application and OS level. Verify compatibility with your deployment model before upgrading, as migration may affect software licensing or specialized workflows.

Detection guidance

Detect exploitation by monitoring for unusual Metal compute shader activity, particularly multiple rapid dispatch sequences from different processes. GPU profiling tools (e.g., Xcode Instruments Metal profiler) can log shader submissions and identify suspicious patterns. Endpoint detection and response (EDR) solutions should flag unexpected GPU compute operations or attempts to read GPU memory state. Detection is challenging post-compromise, as the attack leaves minimal forensic trace; focus on preventing untrusted app installation via code signing and notarization enforcement.

Why prioritize this

This is a HIGH-severity confidentiality breach affecting cryptographic material and secrets in GPU memory. While hardware fixes exist in current Apple Silicon, M1 systems remain widely deployed in enterprise and developer environments. Prioritize based on your M1 inventory size and the extent to which GPU-accelerated cryptography is used in your workflows. For organizations with zero-trust frameworks or regulatory obligations (e.g., handling PII, financial data, or cryptographic keys), this warrants immediate risk review and migration planning.

Risk score, explained

The CVSS 3.1 score of 8.6 is driven by high confidentiality impact (C:H) and the assumption of network-adjacent attack surface (AV:N is scored but local execution is required in practice). The score reflects that no user interaction or privilege escalation is needed once the attacker app is present, and the impact on cryptographic secrets is severe. AC:L assumes straightforward shader exploitation. The score does not penalize scope as heavily because the vulnerability is contained within the GPU's compute context, not system-wide privilege escalation.

Frequently asked questions