CVE-2026-47121

MediumCVSS 6.1

Published: 21/07/2026(UTC)Updated: 05/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

Vulnerability in Sparkle (software update framework for macOS) versions prior to 2.9.2. Insufficient symlink checking in delta application paths allows an attacker with a stolen EdDSA private key to deliver a malicious .delta file that, after signature verification, enables arbitrary file write outside the destination tree, including at root level when AppInstaller runs as root.

Risk Assessment

Risk includes an attacker with a stolen private key gaining full system control via arbitrary root-level file writes, posing a severe integrity threat.

Recommendation

Upgrade Sparkle to version 2.9.2 and secure EdDSA private keys against theft.

Other vulnerabilities in Sparkle

CVE-2026-47122Medium
Sparkle, a software update framework for macOS, up to version 2.9.1, has a vulnerability in the Mach connection authentication mechanism. After stage 1 installation completes, new connections to the Mach service are accepted from any local process without code or team ID verification, potentially allowing unauthorized updates.

Original NVD description (English source)

Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`'s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `<symlink>/foo/bar` then escapes the destination tree via `fopen(path, "wb")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the "drop-in replacement bundle" install they would otherwise have. Version 2.9.2 contains a patch for the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS