Vulnerability details
CVE-2025-10016
sparkle-project Sparkle
Local Privilege Escalation in Sparkle Autoupdate Daemon
CVSS 4.0
8.8High
Official description
The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege escalation to root privileges. It is worth noting that it is possible to spawn Autopudate manually via Installer XPC service. However this requires the victim to enter credentials upon system authorization dialog creation that can be modified by the attacker. This issue was fixed in version 2.7.2
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 4.0 | CVEProject cvelistV5 (CNA) (CERT-PL) | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| sparkle-project | Sparkle | v < 2.7.2 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://cert.pl/en/posts/2025/09/CVE-2025-10015 third-party-advisory
- https://github.com/sparkle-project/Sparkle product
- https://github.com/sparkle-project/Sparkle/discussions/2764 vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-09-16
- Last updated
- 2025-09-16
- State
- Published
- Assigner (CNA)
- CERT-PL
Exploit prediction (EPSS)
0.19%
Probability of exploitation in 30 days
9.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-863Incorrect Authorization