Signature validation bypass via inadequate certificate checks

Improper certificate validation in Apple watchOS before 8.6 allows local users to bypass signature validation through a malicious app. Apple identifies the Security component's certificate parser as performing inadequate checks, but the malformed certificate condition and affected function are undisclosed. Exploitation requires a user to run a malicious app on an Apple Watch Series 3 or later, and the reported consequence is limited to accepting a signature that should fail validation.