What is the CVSS score of CVE-2024-9062?

CVE-2024-9062 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2024-9062?

CVE-2024-9062 affects Archify users on macOS and allows any local user to gain root-level privileges through an unprotected system helper tool.

How to fix or mitigate CVE-2024-9062?

Within 24 hours: Identify all macOS systems running Archify and document their business criticality and user base. Within 7 days: Restrict physical and remote access to affected systems; disable Archify if non-critical, or isolate systems on air-gapped networks if business-critical. Within 30 days: Monitor vendor communications for patch release; develop and test remediation plan including upgrade or alternative solution deployment; complete remediation on all systems before patch availability confirmation.

macOS CVE-2024-9062

EUVD-2024-54672 HIGH

Missing Authentication for Critical Function (CWE-306)

2025-06-11 41c37e40-543d-43a2-b660-2fee83ea851a

Apple Privilege Escalation macOS

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:09 euvd

EUVD-2024-54672

Analysis Generated

Mar 14, 2026 - 21:09 vuln.today

CVE Published

Jun 11, 2025 - 00:15 nvd

HIGH 7.8

DescriptionCVE.org

The Archify application contains a local privilege escalation vulnerability due to insufficient client validation in its privileged helper tool, com.oct4pie.archifyhelper, which is exposed via XPC. Archify follows the "factored applications" model, delegating privileged operations-such as arbitrary file deletion and file permission changes-to this helper running as root. However, the helper does not verify the code signature, entitlements, or signing flags of the connecting client. Although macOS provides secure validation mechanisms like auditToken, these are not implemented. As a result, any local process can establish a connection to the helper and invoke privileged functionality, leading to unauthorized execution of actions with root-level privileges.

AnalysisAI

Local privilege escalation vulnerability in Archify's privileged helper tool (com.oct4pie.archifyhelper) that fails to validate client code signatures, entitlements, or signing flags over XPC. Any local process can invoke the helper to execute arbitrary file operations (deletion, permission changes) with root privileges. With a CVSS score of 7.8 and CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this vulnerability requires local access and low privileges but enables complete system compromise; KEV status, EPSS score, patch availability, and POC status are not provided in available intelligence sources.

Technical ContextAI

This vulnerability exploits a flaw in macOS XPC (inter-process communication) security architecture. Archify follows the 'factored applications' architectural model, where a client application with standard user privileges delegates sensitive operations to a privileged helper daemon running as root. The helper tool, com.oct4pie.archifyhelper, exposes XPC endpoints for privileged operations including arbitrary file deletion and permission modification. The root cause (CWE-306: Missing Authentication for Critical Function) is the absence of client validation mechanisms. macOS provides secure validation primitives—auditToken for process identity verification and code signature/entitlements validation via SecCode APIs—but Archify's helper does not implement any of these checks. Any process on the local system can establish an XPC connection and invoke helper methods without authentication, bypassing the intended privilege separation model.

RemediationAI

Immediate remediation requires vendor patch implementation: (1) Deploy code signature validation in the helper tool using SecCode APIs to verify the connecting client's code signature before accepting XPC connections; (2) Implement entitlements-based access control, restricting helper access only to signed copies of the official Archify client application with required entitlements; (3) Implement auditToken-based validation to verify process identity and prevent spoofing; (4) Add authorization checks for individual XPC methods to enforce least privilege. Until patches are available, mitigation strategies include: (a) Restrict Archify installation to single-user systems or trusted administrator accounts only; (b) Monitor XPC traffic and process creation for suspicious connections to com.oct4pie.archifyhelper; (c) Review file system access logs for unauthorized deletion or permission changes; (d) Check vendor website (Oct4Pie) for security bulletins and patch availability. No workarounds can fully mitigate this vulnerability without code changes.