CVE-2019-8561

HIGH

macOS < 10.14.4 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-8561. PoCs published by 0xmachos.

AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2019-8561, which leverages a TOCTOU (Time-of-Check Time-of-Use) vulnerability in the macOS installer to achieve root code execution. The exploit modifies a GPG Suite DMG to inject a malicious preinstall script, bypassing code signing checks.

Description

A logic issue was addressed with improved validation. This issue is fixed in macOS Mojave 10.14.4. A malicious application may be able to elevate privileges.

Exploits (1)

nomisec WORKING POC 5 stars
by 0xmachos · poc
https://github.com/0xmachos/CVE-2019-8561

This repository contains a proof-of-concept exploit for CVE-2019-8561, which leverages a TOCTOU (Time-of-Check Time-of-Use) vulnerability in the macOS installer to achieve root code execution. The exploit modifies a GPG Suite DMG to inject a malicious preinstall script, bypassing code signing checks.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: macOS installer (versions prior to 10.14.4)
Auth required
Prerequisites: Access to a vulnerable macOS system (pre-10.14.4) · Ability to monitor and modify files in $HOME/Downloads · GPG Suite DMG present in the Downloads directory
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Vendor Advisory x_refsource_misc
https://support.apple.com/HT209600

Scores

CVSS v3 7.8
EPSS 0.0658
EPSS Percentile 93.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (1)
apple/mac_os_x < 10.14.4
Published Dec 18, 2019
Tracked Since Feb 18, 2026