CVE-2025-5199 LPE on Multipass for macOS
Local attackers can escalate privileges on macOS by modifying files executed with administrative privileges due to incorrect default permissions in Multipass.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-5199?
CVE-2025-5199 is a high-severity vulnerability in Canonical Multipass, published on 11 Jul 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying files executed with administrative privileges by a Launch Daemon during system startup.
Which versions are affected by CVE-2025-5199?
It affects 1 product.
Products include Canonical Multipass.
How do I fix CVE-2025-5199?
No fix has been published for CVE-2025-5199 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-5199 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-5199 exists.
Other vulnerabilities in Canonical Multipass
- CVE-2021-3626 Windows version of Multipass unauthenticated localhost tcp control socket can perform mounts
- CVE-2021-3747 MacOS version of Multipass incorrect owner for application directory
- CVE-2026-49238 SFTP Server VM Escape in Canonical Multipass
- CVE-2026-49237 Local Privilege Escalation in Canonical Multipass
Sources
Also known as GHSA-2j82-p5cq-62p3.