EUVD-2026-39410
GHSA-7hqh-37x3-vv4j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description confirms local access by a low-privileged attacker (AV:L, PR:L), no user interaction, and command execution yielding full C/I/A impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
AnalysisAI
OS command injection in Dell Display and Peripheral Manager (DDPM) for macOS, all versions prior to 2.3, allows a low-privileged local user to inject and execute arbitrary operating-system commands through improperly neutralized special elements (CWE-78). Because the affected component is a privileged peripheral-management utility, successful injection can yield command execution with full impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so risk is currently theoretical but high-impact for systems with this Dell utility installed.
Technical ContextAI
Dell Display and Peripheral Manager is a desktop companion application for macOS used to configure Dell monitors and peripherals (brightness, input, presets, firmware/peripheral settings). The flaw is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning the application constructs and passes a string to an operating-system shell or command interpreter without sanitizing attacker-influenced input - allowing shell metacharacters or appended commands to be interpreted as additional instructions. The affected product per CPE is cpe:2.3:a:dell:display_and_peripheral_manager:*:*:*:*:*:*:*:* (application type), with the macOS build being the named platform. Because such management utilities often run with elevated or helper-daemon privileges, a command-injection sink here can escalate the effective permissions of injected commands beyond the originating user context.
RemediationAI
Vendor-released patch: version 2.3 - upgrade Dell Display and Peripheral Manager for macOS to 2.3 or later, per Dell advisory DSA-2026-267 (https://www.dell.com/support/kbdoc/en-hk/000475656/dsa-2026-267). Until the upgrade is applied, reduce exposure by uninstalling DDPM from systems where Dell-monitor management is not actively needed (trade-off: loss of monitor/peripheral configuration features), and restrict local interactive access to the affected Macs to trusted administrators since exploitation requires a local low-privileged account. Because no non-version workaround is published by the vendor, patching to 2.3 is the only confirmed fix; the listed compensating controls limit the local-attacker population but do not remove the underlying injection sink.
Local privilege escalation to code execution affects Dell Display and Peripheral Manager (DDPM) for Windows in all versi
Protection mechanism bypass in Dell Display and Peripheral Manager for Mac (versions prior to 2.3) stems from improper c
Dell Display and Peripheral Manager for macOS prior to 1.3 contains an improper access control vulnerability. Rated high
Local privilege escalation in Dell Display and Peripheral Manager (DDPM) for Mac, versions prior to 2.3, lets a low-priv
Dell Display and Peripheral Manager, versions prior to 2.1.2.12, contains an Execution with Unnecessary Privileges vulne
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today