Mas0nShi/CVE-2026-112445

What it is

CVE-2026-112445 is a macOS local privilege escalation through the system launchd job com.apple.xpc.uscwoap. The job runs Bash as root with its input tied to /dev/console. Apple assigned the CVE but left it out of its security advisory, and the page says the reason is unknown.

How it works

The job's configuration, as the page shows it:

Label             = com.apple.xpc.uscwoap
BootShell         = true
ProcessType       = Interactive
Program           = /bin/bash
ProgramArguments  = [bash, -sh]
StandardInPath    = /dev/console
StandardOutPath   = /dev/console
StandardErrorPath = /dev/console

The job sits in launchd's system domain and names no lower-privileged account, so Bash runs as UID 0. In a graphical login session, /dev/console is owned by the logged-in non-administrator, while the root Bash reads from it. A process running as that user can use TIOCSTI to insert characters into the console input queue. Bash reads them as commands and runs them as root. Nothing in this path checks the authorization of whoever supplies the input.

Preconditions / Affected

• The attacker is a non-administrator logged into the active graphical console.
• The job must be startable through launchd's job control interface, which the page says needs no administrator credentials.
• TIOCSTI injection must work on the build. The page says only "affected builds" and does not list them.
• The BootShell flag suggests a single-user-mode purpose, but the page says the launch path is also available in a normal desktop session.

What to do

Update to macOS 27.2, which removes the com.apple.xpc.uscwoap configuration. The page gives no workaround for earlier releases. The job's label and its plist in the system LaunchDaemons directory give a way to check whether a machine still carries it.

Caveats

The page gives no exact launch command, no proof-of-concept code and no list of affected builds. Because Apple's advisory omits the CVE, it will not appear in Apple's patch notes. The 2020 GitHub question about what uscwoap was for shows the job has been visible for years, but the page does not say since which release it has been exploitable.