EIP-2026-104599

The advisory details multiple local privilege escalation vulnerabilities in the HMAHelper binary of HideMyAss Pro VPN for OS X, which is installed setuid root. The helper allows arbitrary command execution as root due to insufficient validation in the FirewallDisable function, enabling local attackers to escalate privileges.