CVE-2024-12786CWE-266CWE-269

X1a0He Adobe Downloader XPC Service com.x1a0he.macOS.Adobe-Downloader.helper shouldAcceptNewConnection privileges management

High · published December 19, 2024

CVSS v4.0
8.5
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

A vulnerability, which was classified as critical, was found in X1a0He Adobe Downloader up to 1.3.1 on macOS. Affected is the function shouldAcceptNewConnection of the file com.x1a0he.macOS.Adobe-Downloader.helper of the component XPC Service. The manipulation leads to improper privilege management. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. This product is not affiliated with the company Adobe.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00216 · 11.5th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-269 · Improper Privilege Management
Published
2024-12-19T15:00Z
EPSS history
Timeline
  • 19 DEC 15:00Z
    X1a0He Adobe Downloader XPC Service com.x1a0he.macOS.Adobe-Downloader.helper shouldAcceptNewConnection privileges management
    cvelistv5