PoC Published for macOS launchd Privilege Escalation (CVE-2026-112445)
Researcher Mas0nShi disclosed full technical details and a proof-of-concept exploit for CVE-2026-112445, a local privilege escalation vulnerability in macOS versions prior to 27.2. The flaw abuses an unauthenticated LaunchDaemon, com.apple.xpc.uscwoap, which spawns a root-owned interactive Bash shell linked to the console. A standard, non-administrator user logged into the graphical console can start this job via launchd's job control interface without credentials, then use the TIOCSTI ioctl to inject commands into the shell's input queue, achieving root code execution. No in-the-wild exploitation has been reported, but the public GitHub PoC lowers the barrier for abuse, particularly on shared or multi-user Mac deployments common in enterprise environments. Apple has already patched the issue in macOS 27.2 by removing the vulnerable daemon file.
Entenda a falha
A vulnerabilidade
CVE-2026-112445 is a local privilege escalation in macOS versions before 27.2. The LaunchDaemon com.apple.xpc.uscwoap can be started through launchd's job control interface by a non-administrator user logged into the graphical console, with no credentials. The attacker needs local access at the console and gets code execution as root (UID 0). Apple fixed it in macOS 27.2 by removing the daemon file.
Como funciona
The com.apple.xpc.uscwoap job is configured to run Bash as an interactive shell as root, with its input tied to /dev/console. A console user starts the job through launchd without being asked for credentials. Because the desktop user owns the console device, that user can push characters into its terminal input queue using the TIOCSTI ioctl. Bash reads those characters as if typed and runs them with root privileges.
Por que é vulnerável
The root cause is an unauthenticated, legacy LaunchDaemon that exposes a root-owned interactive shell on a terminal device the logged-in user controls. Nothing checks that the caller is an administrator before the job starts, and the console's input queue can be written by a normal user. Apple's fix removes the vulnerable daemon file entirely rather than adding a check. The articles do not say why it went unnoticed.
Onde está
The flaw is in the LaunchDaemon com.apple.xpc.uscwoap, whose daemon file was removed in macOS 27.2.
Como foi descoberta
The researcher Mas0nShi published full technical details and exploit code for the flaw. The articles do not say how it was found or whether it was reported to Apple beforehand, only that Apple has already patched it in macOS 27.2. No exploitation in the wild has been reported.
PoC pública
Mas0nShi published a proof-of-concept exploit in a public GitHub repository. It shows a standard console user starting the uscwoap job and using TIOCSTI to get root commands executed, with no password. It is a working local exploit and is simple to use, so the barrier for abuse is low, especially on shared or multi-user Macs. Patching to macOS 27.2 is urgent even though no in-the-wild use has been seen.
Publicada em: securityonline.info/macos-privilege-escalation-poc-cve-2026-112445/ ↗
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 09:09.
Detalhes técnicos
The com.apple.xpc.uscwoap LaunchDaemon configures Bash as an interactive shell tied to /dev/console. Because the desktop user owns the console device, they can call TIOCSTI to push arbitrary characters into the terminal's input queue; Bash then interprets and executes these as commands with root privileges (UID 0), granting full privilege escalation without any password prompt.
Remediação
Administrators should update affected systems to macOS 27.2 immediately. Security teams are also advised to audit all LaunchDaemons for unknown or legacy service files that could expose similar root-shell attack paths.
Linha do tempo
-
PoC Published for macOS launchd Privilege Escalation (CVE-2026-112445)
ler a análise desta fonte ocultar
Researcher Mas0nShi disclosed full technical details and a proof-of-concept exploit for CVE-2026-112445, a local privilege escalation vulnerability in macOS versions prior to 27.2. The flaw abuses an unauthenticated LaunchDaemon, com.apple.xpc.uscwoap, which spawns a root-owned interactive Bash shell linked to the console. A standard, non-administrator user logged into the graphical console can start this job via
launchd's job control interface without credentials, then use theTIOCSTIioctl to inject commands into the shell's input queue, achieving root code execution. No in-the-wild exploitation has been reported, but the public GitHub PoC lowers the barrier for abuse, particularly on shared or multi-user Mac deployments common in enterprise environments. Apple has already patched the issue in macOS 27.2 by removing the vulnerable daemon file.Technical Details
The
com.apple.xpc.uscwoapLaunchDaemon configures Bash as an interactive shell tied to/dev/console. Because the desktop user owns the console device, they can callTIOCSTIto push arbitrary characters into the terminal's input queue; Bash then interprets and executes these as commands with root privileges (UID 0), granting full privilege escalation without any password prompt.Remediation
Administrators should update affected systems to macOS 27.2 immediately. Security teams are also advised to audit all LaunchDaemons for unknown or legacy service files that could expose similar root-shell attack paths.