Local Privilege Escalation in Sparkle Framework by Catalyst Project

CVE-2025-10015

What is CVE-2025-10015?

The Sparkle framework includes a private XPC service named Downloader.xpc, which is bundled with applications. Due to inadequate validation of connecting clients, an unprivileged local attacker can register this service globally. This allows the attacker to inherit the TCC permissions of the application, enabling access to sensitive TCC-protected files which can be relocated to arbitrary locations. If access to additional resources is required, user interaction via a system prompt is necessary to grant permissions. The issue has been addressed and resolved in version 2.7.2.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References