CVE-2025-4960 macOS Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller Installer
Local attackers can escalate privileges to execute arbitrary commands or install system components via improper authorization checks in the EPSON printer installer helper tool.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4960?
CVE-2025-4960 is a high-severity vulnerability in EPSON Printer Controller Installer, published on 19 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege escalation vulnerability due to multiple flaws in its implementation. It fails to properly authenticate clients over the XPC protocol and does not correctly enforce macOS’s authorization model, exposing privileged functionality to untrusted users. Although it invokes the AuthorizationCopyRights API, it does so using overly permissive custom rights that it registers in the system’s authorization database (/var/db/auth.db).
These rights can be requested and granted by the authorization daemon to any local user, regardless of privilege level. As a result, an attacker can exploit the vulnerable service to perform privileged operations such as executing arbitrary commands or installing system components without requiring administrative credentials.
Weakness: CWE-863
Which versions are affected by CVE-2025-4960?
How do I fix CVE-2025-4960?
No fix has been published for CVE-2025-4960 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-4960 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4960 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-m9vq-r8xh-f85j.