Post #4221551

2026-07-30 01:35 UTC

Apparently on Monday, Apple killed fG!'s bug With any system that has Screen Sharing enabled, it's reported that the vulnerability can allow for remote code execution as root. Apple lists no CVE with such a description. Closest is CVE-2026-43760, which is: An app may be able to access user-sensitive data The navi_the_clown PoC appears to only retrieve files from the target system (root-only is fine).

Replies (2)

@vunix@infosec.exchange 2026-07-30 05:46

@wdormann@infosec.exchange this one I think - https://bynar.io/blog/a-root-remote-command-execution-on-macos-with-m5-in-2026#:~:text=The%20bug%20was%20found%20through%20our%20automated%20vulnerability%2Ddiscovery%20workflow%20using%20GPT%2D5.5%20for%20discovery%20and%20validation:

Open ##4228789
@wdormann@infosec.exchange 2026-07-30 12:10

OK, despite the fact that Google is still unaware of the blog post, @vunix@infosec.exchange pointed out that the referenced blog post is here And confirms that the CVE is: CVE-2026-43760 An app may be able to access user-sensitive data And also mentions that not only does the vulnerability allow for reading of files as root, but also writing. How did Apple screw up the description so bad? No mention of a remote attacker? No mention of the ability to write a file as root, all by an unauthenticated remote attacker? The CVSS is buggered as well: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, which claims that the attack is LOCAL, and also has no effect on Availability or Integrity. (And thus a final score of 5.5) Maybe I'm being naive, but I get the impression that there's a lot that one can do with the ability for an unauthenticated remote attacker to be able to place files as root. 🤦‍♂️

Open ##4239983