Which versions of BuhoCleaner are affected by CVE-2026-0924?

BuhoCleaner 1.15.2 for macOS poses a privilege escalation risk that could allow local users to gain administrative control over affected systems, potentially exposing sensitive data and compromising…

How to fix or mitigate CVE-2026-0924?

Within 24 hours, conduct an inventory of all macOS systems with BuhoCleaner 1.15.2 installed and identify which departments and systems are affected, prioritizing those handling sensitive data. Within 7 days, communicate findings to affected users and begin removal of BuhoCleaner from systems where it is not business-critical; for systems where BuhoCleaner is essential, immediately implement local access controls to restrict usage to trusted, supervised user accounts only. Within 30 days, migrate any dependent workflows to alternative system maintenance tools that have undergone security review, and establish organizational policy requiring security assessment before deploying third-party utilities with elevated system privileges.

BuhoCleaner CVE-2026-0924

Q: What is the CVSS score of CVE-2026-0924?

CVE-2026-0924 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Race Condition (CWE-362)

2026-02-02 help@fluidattacks.com

Privilege Escalation Race Condition Buhocleaner

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local unprivileged user (AV:L/PR:L); race condition makes exploitation timing-dependent (AC:H); root XPC helper is a separate authority so scope changes (S:C) with full C/I/A compromise.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 14, 2026 - 15:07 NVD

7.3 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

CVE Published

Feb 02, 2026 - 23:16 cve.org

HIGH 7.3

CVE Published

Feb 02, 2026 - 23:16 nvd

N/A

DescriptionCVE.org

BuhoCleaner contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects BuhoCleaner: 1.15.2.

AnalysisAI

Local privilege escalation in BuhoCleaner 1.15.2 for macOS lets an authenticated unprivileged user gain root by abusing an insecurely implemented XPC helper service that performs privileged operations without properly validating or synchronizing its callers. The flaw is a CWE-362 race condition (TOCTOU) in the XPC service's privileged functions. No public exploit has been identified at time of analysis and EPSS is negligible (0.01%), consistent with a local-only, non-wormable weakness rather than a mass-exploited network bug.

Technical ContextAI

BuhoCleaner is a commercial macOS system-cleanup/optimization utility from Dr. Buho (CPE cpe:2.3:a:drbuho:buhocleaner:1.15.2:*:*:*:*:macos:*:*). Like many Mac maintenance tools it ships a privileged helper installed via SMJobBless/SMAppService that runs as root and exposes an XPC (Apple's inter-process communication) endpoint so the unprivileged GUI can request root-level actions (deleting protected files, changing permissions, etc.). The root cause class is CWE-362 (concurrent execution using shared resource with improper synchronization), i.e. a time-of-check/time-of-use race: the helper validates a request or a file path and then acts on it, but an attacker can swap the target between the check and the use, or the helper fails to authenticate the connecting client and pin its code identity, so the root-owned operation can be redirected against attacker-controlled resources.

RemediationAI

No vendor-released patched version is identified in the available data - the references point only to the Fluid Attacks advisory (https://fluidattacks.com/advisories/solstafir) and the vendor product/download pages (https://www.drbuho.com/buhocleaner, https://www.drbuho.com/buhocleaner/download), not to a fixed build, so verify with Dr. Buho for a release later than 1.15.2 before assuming a fix exists. As compensating controls: uninstall BuhoCleaner (including its privileged helper via SMAppService/launchd, typically the LaunchDaemon and PrivilegedHelperTools entry) on multi-user or high-value macOS hosts, since removing the root helper eliminates the escalation primitive entirely at the cost of losing the app's cleanup features; restrict interactive/local login on affected machines to trusted users only, since exploitation requires a local account; and monitor for the app's helper being invoked with unexpected file paths or by non-GUI processes. These controls reduce exposure but do not fix the underlying race condition, which only a vendor patch that adds proper client code-signature validation and eliminates the TOCTOU window can address.