macOS flaw lets local attackers gain root privileges

Security researchers publicly released PoC exploit code for a local privilege escalation in Apple macOS, tracked as CVE-2026-112487. The flaw resides in revisiond (com.apple.revisiond), the root LaunchDaemon behind macOS Document Revisions. The advisory notes that an attacker with local access can chain four path-related flaws to gain root privileges in under one second.

Apple’s security notice confirms the impact as “an app may be able to gain root privileges,” with affected builds listed as macOS 26.6 and older on arm64 hardware. The vulnerability is rated CVSS v3.0 at 7.8 (High) and is fixed in macOS Golden Gate, with patched versions 15.8.2, 26.7.2, and 27.2. The report from the researcher Lyutoon, with a public GitHub write-up containing PoC code, states there has been no confirmed exploitation in the wild to date.

The attack relies on four flaws in the document revision daemon’s handling of path operations. First, the XPC listener is described as ungated, allowing local connections without checks. The PoC then utilises predictable temporary file names during document staging, and the daemon calls copyfile on a hardlinked target without safe flags, enabling a hardlink to be placed pointing at the system sudoers file.

The daemon preserves root ownership on target files and allows inherited ACLs on the staging folder, permitting the attacker to overwrite the root-owned clone and modify sudoers to grant full root access without a password. Apple’s patch improves path validation in the storage stack. Users should update to 15.8.2, 26.7.2 or 27.2 immediately and security teams are advised to audit the sudoers file for unknown changes.