A bug in Apple Home called “doorLock” may let attackers trigger device name abuse that can crash iPhones into a recovery-required lockout state.

Discovery of a Critical Apple Home App Vulnerability

Security researcher Trevor Spiniolas reported a bug affecting iOS and the Apple Home that has reportedly existed since at least iOS 14.7. At minimum, attackers can trigger a denial-of-service (DoS) crash; in worst-case scenarios, such flaws can sometimes evolve toward remote code execution (RCE), though not confirmed here.

“doorLock” Bug Targets HomeKit Ecosystem

The vulnerability, dubbed “doorLock,” impacts Apple’s smart home system HomeKit, which manages connected devices like lights, cameras, and thermostats.

Delayed Fix and Partial Mitigation Concerns

Although Apple was notified in 2021, the researcher claims that fixes remain incomplete, leaving potential risk exposure for users. Attack likelihood is low unless someone with HomeKit access or a malicious invite intentionally triggers the issue.

What the Bug Does NOT Do

The flaw does not directly steal passwords, spy on users, install malware, or compromise network data, but it still creates serious usability risks.

Primary Risk: Device Lockups and Forced Recovery

Exploitation can cause iPhones to become unresponsive, potentially forcing users into a full device recovery that erases all data. Users may be unable to access Settings to disable Home due to constant crashes, leaving recovery mode or DFU restore as the only option.

How the Vulnerability is Triggered

The issue occurs when a HomeKit device is given an extremely long name (tens of thousands of characters), overwhelming the app’s processing logic. If Home is enabled in iOS Control Center, the app may auto-load on startup, repeatedly triggering crashes in a loop.

Buffer Overflow-Like Behavior in App Processing

The root cause resembles a memory handling failure where oversized input leads to crashes or system instability. Using DFU or recovery mode wipes device data, making backups essential to avoid permanent loss.