Loading story…
A race condition in Apple’s userspace entitlement and code-signing checks allowed local attackers to bypass authorization in privileged IPC services and escalate to root. Project Zero documented the underlying weakness as racy validation tied to process identity, while a later public write-up showed the issue in practice in com.apple.appleseed.fbahelperd, Apple’s privileged Feedback Assistant XPC service, tracked as CVE-2019-8565.
The exploit abused PID reuse to impersonate a trusted client after the daemon validated the wrong process context, defeating entitlement checks that should have restricted access. Once inside the service, an attacker could invoke copyLogFiles: to copy arbitrary files through path traversal and chain additional helper behavior to achieve root code execution; Apple addressed the flaw in macOS 10.14.4 and iOS 12.2, and researchers said the bug reinforced that PID-based authorization in macOS IPC should be replaced with audit-token-based validation.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
A public technical write-up described how PID reuse could bypass fbahelperd authorization, how path traversal in copyLogFiles: enabled arbitrary file copies, and how those primitives could be chained to root code execution. The post also stated that a proof of concept for CVE-2019-8565 was published publicly.
A Project Zero issue titled "MacOS/iOS userspace entitlement checking is racy" was published, documenting the broader PID-based entitlement checking race pattern affecting Apple user-space IPC authorization.
Apple addressed the local privilege escalation flaw in the privileged XPC service com.apple.appleseed.fbahelperd in macOS 10.14.4 and iOS 12.2. The fix also addressed the underlying trust issue discussed in the write-up for audit-token handling before those releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A researcher disclosed a three-bug macOS local privilege escalation chain that let an unprivileged user escalate to **root**, bypass **System Integrity Protection (SIP)**, and ultimately achieve kernel code execution on systems before `macOS 10.15.5`. The first flaw was in `authd`, where Authorization Services trusted entitlement data returned by `SecCodeCopySigningInformation` without first validating the caller’s code signature, allowing forged entitlements such as `com.apple.private.AuthorizationServices` to unlock privileged authorization rights. The chain then abused Apple-signed package installation through **PackageKit** and a vulnerable post-install script in `macOSPublicBetaAccessUtility.pkg` to execute code as root under `system_installd`, inheriting the `com.apple.rootless.install.heritable` entitlement and bypassing SIP. A third flaw in `kextutil` used a race condition to swap a verified Apple-signed kernel extension staged in `/Library/StagedExtensions/private` before loading; use of the `-interactive` flag made the race reliable enough to load malicious kernel code. The bugs were reported to Apple in 2020, and Apple addressed the issues in `macOS 10.15.6` and `tvOS 13.4.5`, including a change so `SecCodeCopySigningInformation` verifies signatures directly.
Jul 24, 2026
Researchers reported that Apple’s fix for `CVE-2021-30724` in the root-privileged `CVMServer` daemon introduced a new flaw, tracked as `CVE-2022-26721`, that could be reached from the Safari renderer sandbox on macOS. The bug stemmed from uninitialized cleanup metadata left behind when a bounds check aborted processing, creating a path for attacker-controlled `munmap` operations on arbitrary memory pages inside the service. Theori showed the issue could be turned into root code execution by shaping heap contents, using a binary-search-style oracle to infer `CVMServer` memory layout, and overwriting `dyld` private-memory function pointers. A proof of concept reportedly read `/var/db/SystemKey`, which can be used to decrypt macOS keychain files, underscoring the impact of the sandbox escape and privilege-escalation chain. Apple addressed the vulnerability in macOS 12.4 by replacing `malloc` with `calloc` to ensure the descriptor buffer was zero-initialized.
Jul 24, 2026
Researchers disclosed a critical pre-authentication remote code execution flaw in Apple’s `screensharingd` daemon affecting macOS 26.5 and earlier when Screen Sharing is enabled. The bug lies in SRP frame-length validation: an oversized frame can trigger a residual success status, causing the service to treat authentication as completed and enter the post-authentication message loop without performing key exchange or establishing session cryptography. Public write-ups describe the issue as reachable over a single TCP connection and capable of bypassing authentication entirely. The reported impact includes writing attacker-controlled files and escalating to **root** code execution, with one account saying the flaw was confirmed on a Mac mini M4 running macOS 26.3 and that exploitation can be intermittent depending on heap layout. Separate reporting also mentioned an additional SRP zero-key weakness that was not exploited in the demonstrated attack chain. Apple reportedly addressed the primary vulnerability in macOS 26.6 by correctly propagating the error code in `screensharingd`, closing the path to unauthenticated remote compromise.
Aug 10, 2026