BuhoCleaner CVE-2026-0924

Requires an authenticated, unprivileged local user on a macOS system with BuhoCleaner 1.15.2 installed and its privileged XPC helper registered/running (the default state after normal installation, since the helper backs the app's core cleanup functions). The concrete prerequisite is the ability to reach the helper's XPC endpoint and to win a race-condition timing window (CWE-362) against a privileged function that lacks proper client validation or path synchronization. Limiting factors: the attacker must already have local code execution or an interactive account (no remote vector, AV:L, PR:L), and exploitation is probabilistic because it hinges on winning the TOCTOU race (AT:P) - a factor that lowers realistic reliability below what the 7.3 score alone implies. No special non-default configuration is otherwise needed.

This is a genuine local privilege-escalation issue but not an emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N, VC:H/VI:H/VA:H) scores 7.3 (High): local attack surface, already-authenticated low-privileged user, no user interaction, and full confidentiality/integrity/availability compromise of the host once root is obtained - but with an Attack Requirement (AT:P) reflecting the race-condition timing window. EPSS is 0.01% (0th percentile), there is no CISA KEV listing, and no public exploit is identified, so real-world mass exploitation is very unlikely; the realistic threat model is a local user or malware already running on the Mac using this as a root-escalation primitive. Signals are internally consistent: local vector + low EPSS + no KEV all point to targeted/opportunistic local abuse, not widespread remote exploitation. One caveat: AT:P (and the race-condition CWE) means exploitation depends on winning a timing window, which can make reliable exploitation harder than a straight logic bug - treat the 7.3 as an upper bound on ease of exploitation.

An attacker who already has an unprivileged local shell or account on a Mac running BuhoCleaner 1.15.2 connects to the app's root XPC helper and issues a privileged file operation, racing the helper between its path/permission check and the actual operation to redirect it against an attacker-controlled target (e.g. a symlink), thereby writing or executing as root and obtaining a root shell. No user interaction is needed and exploitation is entirely local; success depends on winning the race window, and no public proof-of-concept code has been confirmed.