CVE-2025-10015
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Sparkle framework includes an XPC service Downloader.xpc that is private to the bundled application by default. A local unprivileged attacker can register this service globally, inheriting the application's TCC permissions, and due to lack of client validation copy TCC-protected files to an arbitrary location. Access to other resources requires user interaction. The issue was fixed in version 2.7.2.
Risk Assessment
A local attacker can bypass TCC protection and copy protected files, potentially leading to data leakage.
Recommendation
Upgrade the Sparkle framework to version 2.7.2 or later.
Other vulnerabilities in Sparkle
See all- CVE-2026-47122Medium
Sparkle, a software update framework for macOS, up to version 2.9.1, has a vulnerability in the Mach connection authentication mechanism. After stage 1 installation completes, new connections to the Mach service are accepted from any local process without code or team ID verification, potentially allowing unauthorized updates.
- CVE-2026-47121Medium
Vulnerability in Sparkle (software update framework for macOS) versions prior to 2.9.2. Insufficient symlink checking in delta application paths allows an attacker with a stolen EdDSA private key to deliver a malicious .delta file that, after signature verification, enables arbitrary file write outside the destination tree, including at root level when AppInstaller runs as root.
- CVE-2025-10016High
The Sparkle framework includes a helper tool Autoupdate that does not authenticate connecting clients. A local unprivileged attacker can race to connect to the daemon when another app spawns it as root and request installation of a crafted malicious PKG file, resulting in local privilege escalation to root.
Original NVD description (English source)
The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client allows the attacker to copy TCC-protected files to an arbitrary location. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in version 2.7.2
Vulnerability data from NVD (NIST) · CISA KEV · EPSS