iBoysoft NTFS for Mac CVE-2026-2637

Exploitation requires an existing authenticated local user account with standard privileges (PR:L) on a macOS system where iBoysoft NTFS for Mac version 8.0.0 is installed and the ntfshelperd privileged helper daemon is running. The vulnerability is limited to systems running this specific third-party commercial software, which is not part of default macOS installations. Attack complexity is low (AC:L) because no special configuration beyond software installation is required-the insecure NSConnection service is exposed whenever the helper daemon runs. No user interaction (UI:N) is needed once local access is obtained. The local attack vector (AV:L) significantly limits exploitation to scenarios where the attacker has already gained initial foothold through other means such as phishing, physical access, or exploitation of a separate remote vulnerability. Exploitation is NOT possible remotely without first compromising a local account through another attack vector.

The CVSS 4.0 score of 8.5 reflects high technical severity with local attack vector (AV:L), low complexity (AC:L), and low privileges required (PR:L), resulting in complete compromise of confidentiality, integrity, and availability at the vulnerable component level (VC:H/VI:H/VA:H). However, real-world exploitation risk is constrained by several factors. EPSS probability of 0.02% (6th percentile) indicates the security research community assesses this as very unlikely to be exploited in the wild, consistent with the requirement for existing local access and the niche user base of commercial macOS NTFS utilities. The attack requires authenticated local access to a macOS system running this specific third-party software, limiting the attack surface compared to remotely exploitable vulnerabilities. No CISA KEV listing and no identified public POC suggest this is not currently weaponized for mass exploitation. For organizations using iBoysoft NTFS for Mac, this represents a genuine privilege boundary bypass requiring remediation, but the limited install base and low EPSS score indicate this is unlikely to be a widespread threat vector. Priority should be based on whether the software is deployed in multi-user macOS environments where privilege separation is a security requirement.

An attacker with a standard local user account on a macOS system running iBoysoft NTFS for Mac 8.0.0 writes code to connect to the exposed NSConnection service of the ntfshelperd daemon. Because the daemon performs no authentication or authorization checks, the attacker's process running with standard user privileges successfully establishes a connection to the root-privileged service. The attacker then sends crafted messages through the NSConnection interface to execute arbitrary privileged operations, such as modifying system files, installing persistent malware in protected directories, or creating new administrative user accounts, achieving full root access to the macOS system.