PT-2025-26298
CVE-2025-5963
·
Published
2025-06-20
·
Updated
2025-06-20
Description by
CVSS 4.0
4.8
MediumMetricsAV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions:
Postbox versions (affected versions not specified)
Description:
The Postbox's configuration on macOS allows for Dynamic Library (Dylib) injection due to the presence of certain entitlements. A local attacker with unprivileged access can use environment variables like
DYLD INSERT LIBRARIES to inject code in the application's context and bypass Transparency, Consent, and Control (TCC). The acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted permissions requires user interaction with a system prompt asking for permission.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾