CVE-2026-47122

MediumCVSS 4.2

Published: 21/07/2026(UTC)Updated: 05/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.08%

0th percentile - higher than 0% of all known CVEs

Summary

Sparkle, a software update framework for macOS, up to version 2.9.1, has a vulnerability in the Mach connection authentication mechanism. After stage 1 installation completes, new connections to the Mach service are accepted from any local process without code or team ID verification, potentially allowing unauthorized updates.

Risk Assessment

The organization is at risk that a malicious local process could impersonate an authorized update process and install dangerous software, potentially leading to full compromise of the macOS system.

Recommendation

Monitor for patches from Sparkle developers and temporarily restrict trust in local processes, e.g., by strengthening macOS security policies.

Other vulnerabilities in Sparkle

CVE-2026-47121Medium
Vulnerability in Sparkle (software update framework for macOS) versions prior to 2.9.2. Insufficient symlink checking in delta application paths allows an attacker with a stolen EdDSA private key to deliver a malicious .delta file that, after signature verification, enables arbitrary file write outside the destination tree, including at root level when AppInstaller runs as root.

Original NVD description (English source)

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforces `SUCodeSigningVerifier validateConnection:` before stage 1 completes. After `_performedStage1Installation = YES`, new connections to the registered Mach service `<bundleId>-spki` are accepted from any local process without team-ID or code-signing checks. As of time of publication, no known patched versions are available.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS