macOS LPE Flaw Resurfaces: .localized Directory Exploited to Hijack Installers and Gain Root Access

The macOS LPE flaw resurfaced in December 2025, describing a vulnerability in third‑party installers that can hijack privileged processes and gain root access. The exploit relies on how macOS handles naming conflicts, where an installer placing an application in /Applications can result in a hidden folder named /Applications/Test[.]localized containing the real app, while a fake agent remains in the expected path.

The technique enables a LaunchDaemon to execute a binary at /Applications/Test[.]app as root, giving the attacker full system privileges once the user or an MDM installs the malicious components. The vulnerability was first reported in 2018 by Csaba Fitzl, and while Apple addressed the specific race condition in macOS Sonoma, the underlying logic remains exploitable via the new localized directory vector.

The festival of details includes acknowledgement that Mickey Jin recently secured CVE-2025-24099 for a related fix, according to CVE Watchtower, with the exploit code publicly released by the researcher. The article emphasises that the issue ultimately affects third‑party vendors and remains open until a comprehensive mitigation is delivered.