ClearanceKit CVE-2026-33632

Requires authenticated local access to the macOS system with ClearanceKit deployed (PR:L from CVSS vector). The attacker must be a user subject to ClearanceKit file access policies - exploitation is meaningless without active policy enforcement. The vulnerable process must invoke either exchangedata() or clonefile/clonefileat APIs, which are standard APFS/HFS+ operations available to any local process without special privileges. No specific ClearanceKit configuration setting or feature flag is required - the vulnerability exists in all default deployments prior to 4.2.4. What limits exploitation: (1) requires existing authenticated user account, (2) macOS-specific APIs not available on other platforms, (3) attacker must already have local code execution, and (4) impact is limited to bypassing ClearanceKit policies specifically, not broader system compromise. Organizations not using ClearanceKit are unaffected.

Real-world risk is moderate despite the 8.4 CVSS score. Attack vector is local (AV:L) requiring authenticated access (PR:L), significantly limiting exposure compared to network-based vulnerabilities. CVSS indicates low attack complexity (AC:L) with high confidentiality and integrity impact, but the 0.01% EPSS score (2nd percentile) suggests extremely low observed exploitation probability in the wild. No CISA KEV listing and no public POC confirm this is not being actively exploited. The vulnerability requires the attacker to already have local system access and knowledge that ClearanceKit is deployed - it's an access control bypass, not an initial access vector. SSVC framework assessment: exploitation status is 'none', automatable is 'no' (requires authenticated local access and specific API knowledge), technical impact is 'partial' (bypasses one security control but doesn't grant root). Priority for organizations NOT using ClearanceKit is zero. For ClearanceKit deployments, this is a high-priority patch due to complete policy bypass, but the local-only attack vector and absence of exploitation activity reduce urgency compared to remotely exploitable vulnerabilities with similar CVSS scores.

An authenticated local user subject to ClearanceKit file access restrictions uses the exchangedata() or clonefile() system calls to bypass policy enforcement. For example, a restricted process calls clonefile() to duplicate a sensitive file (e.g., /etc/protected/credentials.db) to a location where the user has read access, successfully exfiltrating data that ClearanceKit policies should have blocked. Alternatively, an attacker uses exchangedata() to atomically swap a malicious file with a system binary, bypassing write restrictions. No public POC exists, but exploitation requires only standard macOS API knowledge and local shell access.