CVE-2025-10906CWE-287CWE-306

CVE-2025-10906

High · published September 24, 2025

CVSS v3.1
8.4
EPSS
0%
Percentile
11.7
In the wild
Unconfirmed
What it is

A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /Applications/Endurance.app/Contents/Library/LaunchServices/com.MagnetismStudios.endurance.helper of the component NSXPC Interface. Executing manipulation can lead to missing authentication. The attack needs to be launched locally. The exploit has been published and may be used.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00218 · 11.7th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2025-09-24T17:15Z
References (5)
https://github.com/SwayZGl1tZyyy/n-days/blob/main/Endurance/README.md · [email protected]https://github.com/SwayZGl1tZyyy/n-days/blob/main/Endurance/README.md#proof-of-concept · [email protected]https://vuldb.com/?ctiid.325691 · [email protected]https://vuldb.com/?id.325691 · [email protected]https://vuldb.com/?submit.653994 · [email protected]
EPSS history
Timeline
  • 24 SEP 13:02Z
    Magnetism Studios Endurance NSXPC com.MagnetismStudios.endurance.helper loadModuleNamed:WithReply missing authentication
    cvelistv5