CVE-2025-14979

Summary

AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.24.6.

Affected Software

Weaknesses

• CWE-732: CWE-732 Incorrect Permission Assignment for Critical Resource

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

References

• https://fluidattacks.com/advisories/blink182
• https://eddie.website/
• https://github.com/AirVPN/Eddie
• https://airvpn.org/forums/topic/79305-eddie-desktop-edition-225-beta-released/

• ←Previous
• Next→