Local privilege escalation via CVMServer integer underflow

Integer overflow in Apple iOS and iPadOS before 14.6 and macOS Big Sur before 11.4 allows local users to gain root privileges. CVMServer's message-type 18 XPC handler subtracts an attacker-controlled begin offset from the mapped length without first ensuring the offset is smaller, wrapping the remaining length and bypassing its bounds check. Exploitation requires low-privileged code execution and an attached connection to the local com.apple.cvmsServ service; the resulting out-of-bounds memory access enables code execution as root.