CVE-2025-10906

Summary

A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /Applications/Endurance.app/Contents/Library/LaunchServices/com.MagnetismStudios.endurance.helper of the component NSXPC Interface. Executing manipulation can lead to missing authentication. The attack needs to be launched locally. The exploit has been published and may be used.

Affected Software

VendorProductVersion RangeStatus
Magnetism StudiosEndurance3.0affected
Magnetism StudiosEndurance3.1affected
Magnetism StudiosEndurance3.2affected
Magnetism StudiosEndurance3.3.0affected

Weaknesses

  • CWE-306: Missing Authentication
  • CWE-287: Improper Authentication

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References