CVE-2025-2098CWE-732

Dylib Hijacking in Fast CAD Reader

High · published March 26, 2025

CVSS v4.0
8.4
EPSS
0%
Percentile
6.6
In the wild
Unconfirmed
What it is

Fast CAD Reader application on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects Fast CAD Reader in possibly all versions since the vendor has not responded to our messages. The tested version was 4.1.5

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
EPSS
0.00175 · 6.6th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-03-26T15:23Z
EPSS history
Timeline
  • 26 MAR 15:23Z
    Dylib Hijacking in Fast CAD Reader
    cvelistv5