Critical AWS VPN Client Flaw CVE-2025-11462 (CVSS 9.3) Allows Root Privilege Escalation on macOS

Amazon Web Services (AWS) has issued a security bulletin warning that the macOS client of the AWS Client VPN contains a critical local privilege escalation vulnerability, tracked as CVE-2025-11462 and rated CVSS v4 9.3.

According to AWS, the flaw arises from insufficient validation of log destination paths during log rotation in the macOS client, allowing a non-administrator user to create a symlink from a client log file to a privileged location such as Crontab, which could then be exploited to achieve root-level code execution. The issue represents a TOCTOU in file handling, where the client trusts a file path that an attacker can manipulate between the check and the write operations.

The vulnerability affects macOS versions 1.3.2 through 5.2.0 of the AWS Client VPN, while Windows and Linux clients, and the cloud-side service, are not affected. AWS has patched the flaw in version 5.2.1 of the macOS client, released earlier this month, and customers using affected versions are advised to update immediately.