macOS EUVD-2026-29240

Requires user interaction to launch a malicious application - the attacker must convince the user to execute the exploit code, typically through social engineering, trojanized software downloads, or compromised application packages. The CVSS vector PR:N indicates no existing privileges are required for the application itself, meaning any unprivileged application run by a standard user can attempt exploitation. No special system configuration, disabled security features, or administrator privileges are required. Exploitation is limited to local access (AV:L), meaning the attacker needs code execution on the target macOS system first, either through the malicious application or prior compromise. The UI:R requirement is the primary limiting factor distinguishing this from wormable or remotely exploitable vulnerabilities.

CVSS 7.8 (High) reflects significant technical impact (full confidentiality, integrity, availability compromise) but requires local access (AV:L) and user interaction (UI:R). Attack complexity is low (AC:L) and requires no privileges (PR:N), meaning any application a user runs could theoretically exploit this. However, real-world risk assessment reveals conflicting signals: EPSS score of 0.02% (4th percentile) indicates security researchers assess exploitation probability as very low, and no CISA KEV listing confirms no active exploitation detected. The UI:R requirement means an attacker needs to trick a user into running a malicious application, not simply achieve remote code execution. From SSVC perspective: exploitation status is none, technical impact is total (root access), but automatability is limited by the UI requirement. This is a genuine privilege escalation worthy of patching, particularly in enterprise environments with untrusted applications, but not an imminent mass-exploitation threat. The low EPSS despite high CVSS suggests sophisticated exploitation requirements not evident from the description alone, or insufficient attacker interest in macOS-specific local exploits.

An attacker distributes a malicious macOS application disguised as legitimate software (e.g., through social engineering, trojanized downloads, or supply chain compromise). When a user launches the application, it exploits the state handling flaw to manipulate privilege management data structures during a system call or authorization check. The application successfully escalates from user-level privileges to root, gaining complete system control to install persistent malware, exfiltrate sensitive data, or disable security controls.