CVE-2026-12374
2026-07-01
15h16 +00:00
15h16 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller verification and a symlink swap during package installation.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Improper Certificate Validation The product does not validate, or incorrectly validates, a certificate. |
||
| Time-of-check Time-of-use (TOCTOU) Race Condition The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. |
