CVE-2026-112445 is a macOS privilege escalation vulnerability in launchd daemons, specifically the legacy system daemon com.apple.xpc.uscwoap. The affected versions are builds before macOS 27.2. The flaw allows a standard desktop user to obtain root rights without a password because the daemon is configured to start Bash as an interactive shell linked to the console. A non-administrator account logged into the active graphical console can start the job through launchd's job control interface without administrator credentials. Once started, the Bash shell runs with root privileges and UID 0, with standard input connected to /dev/console, a device owned by the desktop user. The attacker can use the TIOCSTI terminal control tool to push characters into the console input queue. Bash interprets those characters as commands and executes them with its own root privileges, allowing command execution as root. This creates a serious business impact because shared Macs in office environments can be compromised by a local user, enabling bypass of user checks and creating real risk to office networks.
We recommend you to update macOS to version 27.2.[/subscribe_to_unlock_form]
CVE-2026-112445 is a macOS privilege escalation vulnerability in launchd daemons, specifically the legacy system daemon com.apple.xpc.uscwoap. The affected versions are builds before macOS 27.2. The flaw allows a standard desktop user to obtain root rights without a password because the daemon is configured to start Bash as an interactive shell linked to the console. A non-administrator account logged into the active graphical console can start the job through launchd's job control interface without administrator credentials. Once started, the Bash shell runs with root privileges and UID 0, with standard input connected to /dev/console, a device owned by the desktop user. The attacker can use the TIOCSTI terminal control tool to push characters into the console input queue. Bash interprets those characters as commands and executes them with its own root privileges, allowing command execution as root. This creates a serious business impact because shared Macs in office environments can be compromised by a local user, enabling bypass of user checks and creating real risk to office networks.
We recommend you to update macOS to version 27.2.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]