CVE-2024-12786 Privilege escalation in Adobe Downloader
Local attackers can exploit improper privilege management in the XPC service to escalate privileges on macOS systems using Adobe Downloader.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-12786?
CVE-2024-12786 is a high-severity vulnerability in X1a0He Adobe Downloader, published on 19 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability, which was classified as critical, was found in X1a0He Adobe Downloader up to 1.3.1 on macOS. Affected is the function shouldAcceptNewConnection of the file com.x1a0he.macOS.Adobe-Downloader.helper of the component XPC Service. The manipulation leads to improper privilege management. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. This product is not affiliated with the company Adobe.
Which versions are affected by CVE-2024-12786?
How do I fix CVE-2024-12786?
No fix has been published for CVE-2024-12786 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-12786 being exploited?
There is no known exploitation of CVE-2024-12786 in the wild and no public exploit code.
Sources
Also known as GHSA-2gmr-g5v4-9cch.