CVE-2025-10015: TCC Bypass via Downloader XPC Service in Sparkle
The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client allows the attacker to copy TCC-protected files to an arbitrary location. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission.
This issue was fixed in version 2.7.2
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10015?
CVE-2025-10015 is considered a high-severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2025-10015?
To mitigate CVE-2025-10015, update the Sparkle framework to version 2.7.3 or later where the issue is resolved.
Who is affected by CVE-2025-10015?
CVE-2025-10015 affects applications that utilize the Sparkle framework versions prior to 2.7.3.
What type of attack is possible with CVE-2025-10015?
CVE-2025-10015 allows a local unprivileged attacker to register the Downloader.xpc service globally, potentially inheriting TCC permissions.
Is CVE-2025-10015 a remote vulnerability?
No, CVE-2025-10015 is a local vulnerability, meaning it requires access to the affected system to exploit.