🍎 macOS Local Privilege Escalation: How a LaunchDaemon Misconfiguration Could Give a Standard User Root Access

Security reporting on 4 November 2026 described a proof of concept for CVE-2026-112445, attributed to researcher YingQi Shi, known as Mas0nShi. The reported flaw involves a launchd configuration associated with com.apple.xpc.uscwoap. The job launches /bin/bash as a privileged process and connects its standard input to /dev/console. A standard, non-administrator user logged into the active graphical console could reportedly trigger the job and inject terminal input using the TIOCSTI terminal ioctl, causing the root-privileged shell to interpret attacker-supplied commands.

This is a local privilege-escalation issue: an attacker needs an existing local session or equivalent access to the target Mac. It is not, on the available evidence, a remote unauthenticated vulnerability that can be exploited directly over the internet. The disclosure reported no observed active exploitation at publication time. Apple macOS 27.2 was released on 26 October 2026; secondary reporting says the vulnerable launchd job was removed in that release. Apple’s public security notes do not appear to explicitly list CVE-2026-112445, so users should install the latest applicable Apple software update and consult official release guidance.

launchd is macOS’s service and job manager. It starts and supervises system daemons and user agents based on property-list configuration. System LaunchDaemons commonly run with elevated privileges because they perform operating-system functions. A correctly designed service must strictly control who can start it, which executable it launches, what privileges it receives and where its input comes from.

The reported weakness is a privilege-boundary mismatch: a root-running shell was configured to read from /dev/console, while the active console session was accessible to the logged-in desktop user. If an unprivileged user can cause the privileged shell to start and can supply its input, the shell may execute those commands with root authority.

1. Attacker already has a local session

The described attack assumes a standard, non-admin account is logged into the Mac’s active graphical console. This is not a drive-by web exploit or an attack that begins solely from an external network connection.

2. A launchd job is triggered

The researcher’s report identifies a job associated with com.apple.xpc.uscwoap. The job configuration reportedly launches /bin/bash without dropping to a less-privileged account.

3. The privileged shell inherits console input

The Bash process runs with UID 0 and uses /dev/console for standard input. The logged-in user can interact with the console device in the active session.

4. Terminal input is injected

The proof of concept reportedly uses TIOCSTI, a terminal ioctl that can place characters into a terminal input queue. The root shell reads the injected text as commands.

5. Commands execute with root privileges

Because the shell is running as root, commands it accepts execute with system-level authority. This can allow an attacker to cross the boundary from a standard user to full local system control.

Root is the highest traditional privilege level on macOS. An attacker who reaches root may be able to modify protected system settings, create or alter privileged services, access data beyond the original user’s permissions, interfere with security controls or establish further persistence. The precise impact depends on macOS security mechanisms, system configuration, hardware protections and what the attacker attempts after escalation. A successful local privilege escalation does not automatically prove that data was stolen or that a persistent implant was installed.

• Platform: macOS, according to the disclosure.
• Vulnerability: CVE-2026-112445, described as a local privilege-escalation flaw involving a launchd job.
• Attacker prerequisite: an existing local session, specifically a non-administrator user logged into the active graphical console in the reported scenario.
• Impact: a standard user may obtain a root-privileged shell by causing it to process attacker-controlled console input.
• Proof of concept: public technical details and PoC code were reported by security news coverage.
• Wild exploitation: the disclosure stated that no active exploitation had been observed at publication time.
• Patch status: reporting says macOS 27.2 removed the vulnerable job. Apple’s public security notes do not explicitly name this CVE.

1. 26 October 2026 — Apple’s developer release listing shows macOS 27.2 (build 26B123) released. Secondary reporting identifies this release as removing the vulnerable launchd job.
2. 29 October 2026 — vulnerability-feed tracking indicates the CVE and PoC disclosure appeared in public research feeds.
3. 4 November 2026 — security reporting described the researcher’s technical details and proof of concept for CVE-2026-112445.
4. At disclosure — the researcher’s note, as relayed in reporting, stated that active exploitation had not been observed.

Historical caveat: the supplied input does not provide evidence of earlier exploitation campaigns, victim counts, threat-actor attribution or confirmed abuse before the public disclosure. No actor attribution or victim timeline is asserted.

No threat actor or campaign is identified in the supplied material or the reporting reviewed. The public PoC is a technical demonstration, not evidence that a criminal group or state-sponsored actor has deployed it. A realistic threat scenario would involve an attacker who already has local access—for example, through a compromised standard account, an insider foothold or another initial-access method—and then uses the flaw to elevate privileges. These are possible scenarios, not confirmed events.

• Install the latest macOS security updates available for your exact Mac model and release channel. Use System Settings → General → Software Update and enable automatic security updates where appropriate.
• Do not use a daily account with administrator privileges unless required. Use a standard account for routine work and a separate admin account for approved maintenance.
• Do not share local accounts. Remove old or unknown accounts and review who has interactive access to shared Macs.
• Be cautious with untrusted applications, scripts, terminal commands and remote-support sessions. A local privilege-escalation flaw becomes more useful after initial access.
• Organisations should monitor changes to LaunchDaemons and LaunchAgents, especially unexpected root jobs, unusual executable paths and services with console-connected input/output.
• Review endpoint telemetry for unexpected launchctl activity, root-running shell processes and unusual process ancestry. Preserve logs before remediation if compromise is suspected.
• Use FileVault, strong account passwords, MFA for cloud services, least privilege, application controls and endpoint detection as layered safeguards.

• Confirm the installed macOS build and whether the relevant Apple update is applied.
• Inventory system and third-party LaunchDaemons/LaunchAgents; compare them with a trusted baseline.
• Review plist ownership, permissions, executable paths, RunAtLoad/KeepAlive settings and configured user/group context.
• Investigate unexpected root-running shells, unusual launchctl activity and terminal input injection indicators.
• Correlate local account logins, process execution, endpoint alerts and changes to privileged configuration files.
• If there is evidence of exploitation, isolate the Mac according to incident-response policy, preserve forensic evidence, rotate credentials from a clean device and rebuild if system integrity cannot be trusted.

CVE-2026-112445 should not be described as a remote code-execution flaw or a vulnerability that lets any internet user instantly take over a Mac. The reported method requires local access to an interactive console session. It is also not evidence that every Mac has been compromised, that all launchd services are unsafe, or that the PoC has been used in real-world attacks.

This disclosure is a reminder that operating-system privilege boundaries depend on careful service configuration. A root process must never accept untrusted input from a less-privileged user without strict controls. For Mac users, the practical response is straightforward: keep macOS updated, use standard accounts for daily work, limit local access and report suspicious activity. For defenders, review privileged launch jobs and correlate process behaviour rather than relying on a single alert.

• SecurityOnline reporting as relayed by CyberSIXT, 4 November 2026
• Apple Developer release listing — macOS 27.2 (26B123), 26 October 2026
• Apple security content for macOS Tahoe 26.7.2
• Additional technical reporting

Methodology note: Based on the supplied input and public reporting available on 4 November 2026. The supplied primary URL points to an unrelated Pune fraud story and was not used as evidence for the macOS vulnerability. No proof of concept was executed. Apple’s public advisory omission is noted rather than interpreted as proof that no fix exists.