CVE-2025-14979CWE-732

CVE-2025-14979

High · published January 6, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
6.4
In the wild
Unconfirmed
What it is

AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.24.6.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00173 · 6.4th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-01-06T21:15Z
Affected products (1)
ProductVersionsFixed in
airvpn/eddieall versions—
References (4)
https://airvpn.org/forums/topic/79305-eddie-desktop-edition-225-beta-released/ · [email protected]https://eddie.website/ · [email protected]https://fluidattacks.com/advisories/blink182 · [email protected]https://github.com/AirVPN/Eddie · [email protected]
EPSS history
Timeline
  • 06 JAN 15:15Z
    Eddie VPN 2.24.6 - Local Privilege Escalation
    cvelistv5