CVE-2025-5963

The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker with unprivileged access can use environment variables like DYLD_INSERT_LIBRARIES to successfully inject code in application's context and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. The original company behind Postbox is no longer operational, the software will no longer receive updates. The acquiring company (em Client) did not cooperate in vulnerability disclosure.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2025/06/tcc-bypass/
https://www.postbox-inc.com/

Configurations

No configuration.

History

23 Jun 2025, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-20 10:15

Updated : 2025-06-23 20:16

NVD link : CVE-2025-5963

Mitre link : CVE-2025-5963

CVE.ORG link : CVE-2025-5963

JSON object : View

Products Affected

No product.

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2025-5963", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "cvd@cert.pl"}], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-06-20T10:15:22.450", "references": [{"url": "https://cert.pl/en/posts/2025/06/tcc-bypass/", "source": "cvd@cert.pl"}, {"url": "https://www.postbox-inc.com/", "source": "cvd@cert.pl"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "The Postbox's configuration on macOS, specifically the presence of entitlements: \"com.apple.security.cs.allow-dyld-environment-variables\" and \"com.apple.security.cs.disable-library-validation\" allows for Dynamic Library (Dylib) injection. A local attacker with unprivileged access can use environment variables like DYLD_INSERT_LIBRARIES to successfully inject code in application's context and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission.\n\nThe original company behind Postbox is no longer operational, the software will no longer receive updates. The acquiring company (em Client) did not cooperate in vulnerability disclosure."}, {"lang": "es", "value": "La configuraci\u00f3n de Postbox en macOS, en concreto la presencia de los permisos \"com.apple.security.cs.allow-dyld-environment-variables\" y \"com.apple.security.cs.disable-library-validation\", permite la inyecci\u00f3n de librer\u00edas din\u00e1micas (Dylib). Un atacante local con acceso sin privilegios puede usar variables de entorno como DYLD_INSERT_LIBRARIES para inyectar c\u00f3digo en el contexto de la aplicaci\u00f3n y eludir la Transparencia, Consentimiento y Control (TCC). El acceso a los recursos adquiridos se limita a los permisos previamente otorgados por el usuario. El acceso a otros recursos, adem\u00e1s de los permisos otorgados, requiere la interacci\u00f3n del usuario con un mensaje del sistema solicitando permiso. La empresa original responsable de Postbox ya no est\u00e1 operativa y el software ya no recibir\u00e1 actualizaciones. La empresa compradora (em Client) no cooper\u00f3 en la divulgaci\u00f3n de la vulnerabilidad. "}], "lastModified": "2025-06-23T20:16:40.143", "sourceIdentifier": "cvd@cert.pl"}