Local Privilege Escalation Vulnerability in Sparkle Framework by Sparkle

CVE-2025-10016

What is CVE-2025-10016?

The Sparkle framework's Autoupdate helper tool is vulnerable to exploitation due to improper authentication of connecting clients. This flaw allows a local unprivileged attacker to request the installation of a specially crafted malicious PKG file while racing to connect to the daemon when a legitimate application spawns it with root privileges. Additionally, it is possible for an attacker to manipulate the system authorization dialog triggered when spawning Autoupdate manually, requiring the victim to provide credentials, further facilitating unauthorized access. Users should upgrade to version 2.7.2 to mitigate this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References