TI-2025-09193 Aliases CVE-2025-10015 GHSA-fvpx-gx3c-pq7f

TCC Bypass via Downloader XPC Service in Sparkle

LOW 21CWE-863Published 2025-09-16 · Updated 2025-09-16

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client allows the attacker to copy TCC-protected files to an arbitrary location. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in version 2.7.2

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00171 6th percentileScored 2026-11-07

Fix Fixed Sparkle (Sparkle Project): 2.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sparkle-project	Sparkle	before 2.7.2	2.7.2	Patch available	CNA

Sparkle Vendorsparkle-project Affected before 2.7.2 Fixed in 2.7.2 Patch available CNA

Remediation

Fix · CNA Sparkle (Sparkle Project) Fixed in 2.7.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2025-09-16
Sparkle — github.com/sparkle-project/Sparkle/discussions/2764
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-09194 Local Privilege Escalation in Sparkle Autoupdate DaemonPriority LOW 37
Show all 2 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-10015
2026-10-03 Alias added: GHSA-fvpx-gx3c-pq7f

References

Advisory 2

Other 1

https://github.com/sparkle-project/Sparkle

TI-2026-34713 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta CVSS 3.1MEDIUM 6.1
TI-2025-09194 Local Privilege Escalation in Sparkle Autoupdate Daemon CVSS 4.0HIGH 8.8
TI-2025-00423 Signing Checks Bypass CVSS 3.1HIGH 7.3
TI-2026-34714 Missing authentication in sparkle-project Sparkle CVSS 3.1MEDIUM 4.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences