EUVD-2026-88311
GHSA-j6v8-h79v-8cqh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local session on macOS host
-
DeliveryCraft malicious parameters for copyConsoleIntoFileFromStartDate:
-
ExploitSend request over XPC to com.extegrity.LogTool helper
-
ExecutionInject shell metacharacters into syslog command
-
ImpactExecute arbitrary commands as root via LaunchSynchronous
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have an unprivileged local user session on a macOS system where Exam4 and its com.extegrity.LogTool privileged helper are installed and running (the helper must be registered/reachable over XPC). Exploitation is limited to local access (AV:L) and needs the ability to send crafted XPC messages invoking [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] with attacker-controlled parameters; no additional user interaction (UI:N) and only low privileges (PR:L) are required, but remote exploitation is not possible. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a classic local privilege escalation: an attacker who already has a low-privileged local session on the macOS host abuses command injection in a root-running privileged helper (com.extegrity.LogTool) reached over XPC, gaining full root. Attack complexity is low and no user interaction is needed, so once local code execution exists, escalation is reliable. However, this is NOT a remotely reachable issue - AV:L means the attacker must already be on the machine, which sharply limits mass exploitation. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the input, so this is 'no public exploit identified at time of analysis' rather than an active-exploitation priority. Net: a real and technically sound LPE worth patching on affected endpoints, but its real-world urgency is bounded by the local-access precondition and the niche footprint of the product, not a widespread emergency. |
| Exploit ScenarioDerived | A student or user running the Exam4 client on a shared or personally-controlled macOS machine crafts malicious parameters and sends them over XPC to the com.extegrity.LogTool helper, whose copyConsoleIntoFileFromStartDate: method passes them unsanitized into a syslog command executed via LaunchSynchronous. The injected shell metacharacters cause arbitrary commands to run as root, giving the local attacker full control of the machine. No public proof-of-concept is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Local privilege escalation in Extegrity Exam4 on macOS lets any unprivileged local user escalate to full root by abusing command injection in the root-running com.extegrity.LogTool privileged helper, which is reachable over XPC. An attacker with a low-privileged local session (PR:L, AV:L, no user interaction required, UI:N) can send crafted XPC messages that reach [ConsoleLogHelper copyConsoleIntoFileFromStartDate:], where attacker-controlled parameters are passed into a syslog command without sanitization and executed with root privileges via LaunchSynchronous, yielding complete confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, HIGH). Exploitation requires the helper to be installed, registered, and reachable on the host; remote exploitation is not possible, and no public exploit code was identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must initially rely on compensating controls until Extegrity publishes a fixed Exam4 build. The most effective control is to eliminate the attack surface: unload and remove the com.extegrity.LogTool privileged helper where Exam4 functionality permits - for example unload its launchd job (launchctl bootout system/<label> for the helper's LaunchDaemon) and remove the helper binary from the privileged helper tools location and its associated plist, with the trade-off that Exam4's log-collection/console-capture features that depend on the helper will stop working and may need to be evaluated for exam-integrity requirements. If the helper cannot be removed, restrict who can reach it by tightening the XPC/Mach service access controls on the launchd job (limiting Mach service access to the Exam4 application's code signing identity where the deployment permits), and consider running Exam4 only for the duration of an exam session on hosts where no untrusted local user account or process can run concurrently, since exploitation requires an existing unprivileged local session. Detection should focus on anomalous syslog invocations or unexpected child processes spawned by com.extegrity.LogTool, and on monitoring the helper's XPC endpoint for non-Exam4 callers. Because the injected command runs synchronously as root through LaunchSynchronous, host integrity monitoring and removal of the helper on kiosk/exam machines remain the highest-value mitigations. Consult https://pentraze.com/vulnerability-reports for the reporter's current guidance and check Extegrity's official channels for a patched Exam4 release before re-enabling the helper.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Exam4 is a macOS exam-delivery application from Extegrity that ships a privileged helper tool, com.extegrity.LogTool, installed with root privileges (the macOS privileged-helper pattern, typically deployed via SMJobBless/launchd) and exposed to the application over XPC, Apple's inter-process communication mechanism for Mach services. The vulnerability is a classic OS command injection (CWE-78): the helper method [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] builds a syslog command string from parameters supplied by the calling XPC client and executes it without proper sanitization or argument escaping, so an attacker who can invoke that method can append shell metacharacters and run arbitrary commands. Because the helper runs as root and the code path uses LaunchSynchronous to execute synchronously in the helper context, injected commands inherit root privileges. The CPE cpe:2.3:a:extegrity:exam4:*:*:*:*:*:*:*:* indicates a wildcard across Exam4 versions, meaning no specific fixed version has been enumerated in the available data. The required precondition is that the com.extegrity.LogTool helper is present, registered with launchd, and reachable over its XPC service by a local process.
Know when Exam4 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local XPC access from a low-privileged user (AV:L/PR:L) with straightforward command injection (AC:L) yields root, giving full C/I/A:H on the same system (S:U).
Primary rating from Vendor (Pentraze).
CVSS VectorVendor: Pentraze
DescriptionCVE.org
Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC. The [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] method executes a syslog command using attacker-controlled parameters without proper sanitization, enabling command injection. Successful exploitation allows a local attacker to execute arbitrary commands with root privileges through LaunchSynchronous.
Executive ViewAI
Extegrity Exam4 on macOS contains a high-severity local privilege escalation in its root-running com.extegrity.LogTool helper, allowing any low-privileged local user to gain full root control of the Mac. Because no vendor-released patch is identified at time of analysis and the helper must be installed, registered, and reachable, Macs running Exam4-especially exam administration and student testing endpoints-face a credible risk of full endpoint compromise, exam integrity loss, and unauthorized access to sensitive data. No public exploit identified at time of analysis, but leadership should prioritize immediate containment and vendor engagement because a single local user account could expose the institution to broad downstream harm.
No vendor-released patch identified at time of analysis; interim mitigations include removing or disabling the com.extegrity.LogTool privileged helper where Exam4 is not essential, restricting local interactive access, unloading the helper via MDM, monitoring for suspicious syslog process execution from the helper, enforcing least privilege, isolating exam-administration Macs, and engaging the vendor for workarounds and patch timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB