When Queues Become Vulnerabilities: Reverse Engineering GCD, XPC Races, and macOS Detection
Olivia Gallucci
Black Hat USA 2026 · Day 2 · Briefings
In this Black Hat USA talk, Olivia Gallucci, a Security Engineer at Datadog, meticulously dissects how the misuse of Apple's **Grand Central Dispatch (GCD)** framework can introduce critical race conditions and other concurrency vulnerabilities into macOS system services. The presentation highlights that what might appear as mere reliability bugs in typical applications can escalate into significant security flaws when present in privileged system daemons, potentially leading to arbitrary code execution in a root context. Gallucci provides a comprehensive guide for both vulnerability researchers and detection engineers, emphasizing the need to understand the underlying mechanics of concurrency, queue management, and synchronization within the macOS ecosystem.
AI review
A competent primer on GCD concurrency bugs and their security implications, anchored by a well-chosen historical CVE. Good for detection engineers new to macOS internals, but no original research — this is synthesis and pedagogy, not discovery.