Dynamic Library Injection Vulnerability in Postbox Email Client

CVE-2025-5963

What is CVE-2025-5963?

The configuration of Postbox on macOS allows for Dynamic Library injection due to certain entitlements. A local attacker with unprivileged access can exploit this by utilizing environment variables like DYLD_INSERT_LIBRARIES to inject malicious code into the application's context. While the access to system resources is confined to permissions already granted by the user, any request for additional access prompts user interaction. The original developers of Postbox are no longer operational, and the acquiring company has not engaged in the necessary vulnerability disclosure process.

References