CVE-2026-47122
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Sparkle, a software update framework for macOS, up to version 2.9.1, has a vulnerability in the Mach connection authentication mechanism. After stage 1 installation completes, new connections to the Mach service are accepted from any local process without code or team ID verification, potentially allowing unauthorized updates.
Risk Assessment
The organization is at risk that a malicious local process could impersonate an authorized update process and install dangerous software, potentially leading to full compromise of the macOS system.
Recommendation
Monitor for patches from Sparkle developers and temporarily restrict trust in local processes, e.g., by strengthening macOS security policies.
Other vulnerabilities in Sparkle
See all- CVE-2026-47121Medium
Vulnerability in Sparkle (software update framework for macOS) versions prior to 2.9.2. Insufficient symlink checking in delta application paths allows an attacker with a stolen EdDSA private key to deliver a malicious .delta file that, after signature verification, enables arbitrary file write outside the destination tree, including at root level when AppInstaller runs as root.
- CVE-2025-10016High
The Sparkle framework includes a helper tool Autoupdate that does not authenticate connecting clients. A local unprivileged attacker can race to connect to the daemon when another app spawns it as root and request installation of a crafted malicious PKG file, resulting in local privilege escalation to root.
- CVE-2025-10015Medium
The Sparkle framework includes an XPC service Downloader.xpc that is private to the bundled application by default. A local unprivileged attacker can register this service globally, inheriting the application's TCC permissions, and due to lack of client validation copy TCC-protected files to an arbitrary location. Access to other resources requires user interaction. The issue was fixed in version 2.7.2.
Original NVD description (English source)
Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforces `SUCodeSigningVerifier validateConnection:` before stage 1 completes. After `_performedStage1Installation = YES`, new connections to the registered Mach service `<bundleId>-spki` are accepted from any local process without team-ID or code-signing checks. As of time of publication, no known patched versions are available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS