Which versions of Eddie are affected by CVE-2025-14979?

AirVPN Eddie 2.24.6 for macOS exposes a local privilege escalation vulnerability allowing any unprivileged user with system access to gain root-level control, creating a pathway for full system…

How to fix or mitigate CVE-2025-14979?

Within 24 hours, identify all macOS systems running AirVPN Eddie 2.24.6 and notify affected users and administrators of the privilege escalation risk. Within 7 days, implement immediate compensating controls including restricting unprivileged local account creation where feasible and enabling enhanced auditing for privilege escalation attempts on affected systems; subscribe to AirVPN vendor security advisories for patch availability. Within 30 days, monitor AirVPN vendor advisories closely and apply any released patch immediately upon availability; conduct a review of user account provisioning practices on macOS endpoints to minimize future local attack surface.

Eddie CVE-2025-14979

Q: What is the CVSS score of CVE-2025-14979?

CVE-2025-14979 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-01-06 help@fluidattacks.com

Privilege Escalation Apple Eddie

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:30 vuln.today

CVE Published

Jan 06, 2026 - 16:15 nvd

HIGH 8.5

DescriptionCVE.org

AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.24.6.

AnalysisAI

Local privilege escalation in AirVPN Eddie 2.24.6 for macOS lets an unprivileged local user gain root by abusing an insecure XPC helper service. Because the privileged helper exposes its XPC interface without properly validating connecting clients, any local account can invoke privileged operations and elevate to root. No public exploit has been identified at time of analysis and EPSS risk is very low (0.02%), consistent with a local-only, non-remote flaw.