Do Son 
TL;DR
Security researcher Ilya Andr from PT MAZE recently uncovered a critical flaw in macOS. The macOS DesktopServicesHelper vulnerability allows local attackers to elevate privileges directly to root. Furthermore, technical details of the vulnerability and working proof-of-concept exploit code have been publicly disclosed.
- CVE: CVE-2026-43783
- CVSS: 7.8 (High · CVSSv3)
- Product: Apple macOS
- Affected: < 26.6
- Status: No confirmed exploitation yet
- Patched in: 26.6
- EPSS: 0.2% (30-day)
- Action: Update to 26.6 now
Track every Apple CVE the moment it's exploited.
Get free email alertsWhy It Matters
Industry estimates suggest that over 100 million Mac devices run modern macOS installations worldwide. Therefore, flaws that grant root access pose a grave threat to desktop environments. This vulnerability carries a severe local privilege escalation risk. Specifically, an untrusted application can bypass operating system access controls completely.
Fortunately, researchers have confirmed no active exploitation in the wild. However, technical analysis and a functional proof-of-concept exploit are now available on GitHub. Consequently, threat actors can adapt the exploit to compromise unpatched Mac systems. Security researcher Ilya Andr published an in-depth breakdown of the macOS DesktopServicesHelper vulnerability via PT SWARM. System administrators must understand the threat to protect enterprise devices.
How The Attack Works
The Insecure XPC Dispatcher
The weakness resides inside the DesktopServicesHelper daemon. The Finder application uses this helper process to perform administrative file tasks. When handling requests, the daemon inspects client sandbox tokens. If an application runs in a sandbox, the service compares command names against an internal allowlist.
The service permits seven specific actions, including the RepairPermissionsForCloudItems command. However, the service does not verify security entitlements for sandboxed callers executing this routine. As the researcher notes, “The daemon that Finder uses to ‘repair’ permissions on iCloud files turned out to be willing to repair permissions on anything – including system directories.”
Arbitrary File Ownership Changes
The daemon extracts target file paths from the incoming XPC dictionary without sanitization. Then, the handler checks if the current file owner matches the calling user ID. If the owner IDs differ, the service invokes the fchown system call.
Crucially, the helper fails to verify directory boundaries. The advisory observes that “The daemon calls fchown on whatever path is provided, without checking that it resides in ~/Library/Mobile Documents/ or any iCloud container.” Furthermore, the function recurses into child directories. Therefore, passing a sensitive system path grants the attacker ownership of all enclosed files. The researcher emphasized this danger, writing, “One XPC request – and any file or directory is ours.”
Escalating To Root Via Pluggable Authentication Modules
Attackers turn this arbitrary ownership primitive into root access through PAM configuration files. Normally, the system restricts access to the /private/etc/pam.d directory. An attacker sends an XPC request targeting this specific folder. The daemon recursively changes folder ownership to the attacker UID.
Next, the attacker creates a file named sudo_local containing the pam_permit module rule. This module instructs the authentication system to accept any password input automatically. Finally, the attacker executes the sudo utility to open a root shell. The PoC is available on GitHub.
Affected Versions
This security flaw impacts macOS versions prior to version 26.5. Earlier operating system releases containing the unpatched helper daemon also remain vulnerable. Systems running default configurations expose the service to local applications.
Patch Or Mitigation Steps
Apple addressed the issue by adding an explicit entitlement check to the helper service. Now, callers must hold the com.apple.private.desktopservices.cloud-repair-perm entitlement. If a connecting process lacks this key, the daemon terminates the connection immediately.
Users should update their Mac devices to macOS 26.5 or later without delay. Administrators managing corporate fleets should enforce operating system updates across all managed endpoints. In addition, organizations should restrict untrusted application installations using mobile device management profiles. Promptly patching this critical macOS DesktopServicesHelper vulnerability prevents unauthorized root account access.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
