PT-2025-39246

CVE-2025-10906

Published

2025-09-24

Updated

2025-09-29

Description by

CVSS 3.1

8.4

High

MetricsAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magnetism Studios Endurance versions up to 3.3.0

Description A security issue exists in Magnetism Studios Endurance on macOS. The loadModuleNamed:WithReply function within the file /Applications/Endurance.app/Contents/Library/LaunchServices/com.MagnetismStudios.endurance.helper component, specifically the NSXPC Interface, is susceptible to manipulation that can result in missing authentication. The attack requires local access.

Recommendations Versions prior to 3.3.0 should be updated.

Exploitability

Exploit

Fix

Impacts

Researchers

Swayzgl1Tzyyy

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

CWE-306: Missing Authentication for Critical Function