CVE-2026-0924CWE-367

BuhoCleaner 1.15.2 - Local Privilege Escalation via PID reuse attack

High · published February 2, 2026

CVSS v4.0
7.3
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

BuhoCleaner contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects BuhoCleaner: 1.15.2.

The record
Technical detail
CVSS v4.0
7.3 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00180 · 7.1th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-02-02T20:18Z
EPSS history
Timeline
  • 02 FEB 20:18Z
    BuhoCleaner 1.15.2 - Local Privilege Escalation via PID reuse attack
    cvelistv5