Researcher discloses macOS root exploit for CVE-2026-112445

A security researcher known as Mas0nShi has disclosed full details and PoC exploit code for CVE-2026-112445, a macOS privilege-escalation flaw. The issue is described as a straightforward bug in launchd daemons that can let a standard desktop user obtain root privileges without a password. The disclosure includes a public GitHub repository with the PoC, and the author notes that, at the time of the report, there had been no observed active exploitation in the wild.

The attack chain, as explained in the report, targets an unauthenticated LaunchDaemon tied to the com.apple.xpc.uscwoap service. This daemon configures Bash as an interactive shell linked to the console. A non-administrator user who is logged into the active graphical console can start this job through launchd’s control interface without needing administrator credentials. Once started, Bash runs as root (UID 0) and its standard input is tied to /dev/console, which is owned by the desktop user.

By pushing text into the console input queue via the TIOCSTI terminal control operation, the attacker can have Bash interpret commands with root privileges. The advisory states that macOS builds earlier than 27.2 are affected, and Apple mitigated the flaw in macOS 27.2 by removing the daemon file. Administrators are advised to upgrade to macOS 27.2 and audit LaunchDaemons for unknown files.