CVE-2025-10016
HIGH EPSS 9.3%
Published Sep 16, 20259mo ago · Modified Jun 17, 20262w ago
8.8 CVSS 4.0
Published Sep 16, 2025 9mo ago
Last Modified Jun 17, 2026 2w ago
Description
The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege escalation to root privileges. It is worth noting that it is possible to spawn Autopudate manually via Installer XPC service. However this requires the victim to enter credentials upon system authorization dialog creation that can be modified by the attacker. This issue was fixed in version 2.7.2
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
9.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-863 Incorrect Authorization Authorization
References 3
- cert.pl https://cert.pl/en/posts/2025/09/CVE-2025-10015
- github.com https://github.com/sparkle-project/Sparkle
- github.com https://github.com/sparkle-project/Sparkle/discussions/2764
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.