EUVD-2025-209938CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able to gain root privileges.
AnalysisAI
Local privilege escalation in Apple macOS allows a malicious app already running with low privileges to elevate to root by exploiting a logic flaw (improper privilege management) that was resolved with additional validation checks. The flaw affects macOS Sonoma before 14.8, macOS Sequoia before 15.7, and macOS Tahoe before 26, and was reported by Apple itself. There is no public exploit identified at time of analysis and no EPSS or KEV signal was provided, indicating no confirmed active exploitation.
Technical ContextAI
The affected component is Apple's macOS operating system (cpe:2.3:a:apple:macos), spanning the Sonoma, Sequoia, and Tahoe release trains. The root cause is classified as CWE-269 (Improper Privilege Management): a code path performed an action or trusted a state without correctly enforcing the privilege boundary it should have. Apple's own characterization - 'a logic issue addressed with improved checks' - confirms this was a missing or insufficient authorization/validation check rather than a memory-corruption bug, which is consistent with the high integrity and confidentiality impact in the CVSS vector. Because scope is Unchanged (S:U), the elevation occurs within the same security authority (the OS kernel/privileged services) rather than crossing into a separate sandbox or VM boundary.
RemediationAI
Apply the vendor-released patch by upgrading to the fixed builds: macOS Sonoma 14.8, macOS Sequoia 15.7, or macOS Tahoe 26, depending on your installed train, as documented in Apple's advisories at https://support.apple.com/en-us/125110, https://support.apple.com/en-us/125111, and https://support.apple.com/en-us/125112. No vendor-provided workaround is published; because exploitation requires a malicious or compromised application running locally, interim compensating controls should focus on reducing untrusted local code execution: keep Gatekeeper and System Integrity Protection enabled and do not disable them (disabling SIP would broaden, not reduce, exposure), restrict installation to apps from the App Store or identified developers, and limit the number of low-privilege local accounts that can run arbitrary software. These controls reduce the chance an attacker obtains the local low-privilege foothold the bug requires, but they do not remediate the flaw itself - patching is the only complete fix.
More from same product – last 7 days
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config
Arbitrary code execution in Docker Model Runner's vllm-metal inference backend on macOS allows any container on the Dock
Arbitrary code execution in Docker Desktop's Model Runner on macOS allows any container on the Docker network to escape
Local privilege escalation in Canonical Multipass for macOS before 1.16.3 allows a low-privileged local user to obtain r
Local privilege escalation in Apple macOS allows a malicious or compromised application to win a race condition (CWE-362
Share
External POC / Exploit Code
Leaving vuln.today