{"id":"CVE-2026-2637","aliases":["EUVD-2026-9287","GHSA-85jh-jp4r-37r3"],"status":"published","title":"iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged...","description":"iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection service that runs as root without implementing any authentication or authorization checks.\n\nThis issue affects iBoysoft NTFS: 8.0.0.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0019,"percentile":0.08788,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-732"],"published":"2026-03-03T14:04:28Z","modified":"2026-06-17T10:31:26Z","products":[{"vendor":"iboysoft","product":"iboysoft ntfs"},{"vendor":"iboysoft","product":"ntfs_for_mac"}],"references":[{"url":"https://fluidattacks.com/advisories/cuarteto","tags":["third-party-advisory","Exploit","Third Party Advisory"]},{"url":"https://iboysoft.com/ntfs-for-mac/","tags":["product","Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2637"},{"url":"https://iboysoft.com/ntfs-for-mac"},{"url":"https://github.com/advisories/GHSA-85jh-jp4r-37r3"}],"sources":{"cve":[{"id":"CVE-2026-2637","description":"iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection service that runs as root without implementing any authentication or authorization checks.\n\nThis issue affects iBoysoft NTFS: 8.0.0.","status":"published","published":"2026-03-03T14:04:28.459Z","modified":"2026-03-03T14:35:43.673Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T13:48:46.911326Z"}],"euvd":[{"id":"EUVD-2026-9287","description":"iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection service that runs as root without implementing any authentication or authorization checks.\n\nThis issue affects iBoysoft NTFS: 8.0.0.","status":"published","published":"2026-03-03T14:04:28Z","modified":"2026-03-03T14:35:43Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:48:12.247854Z"}],"ghsa":[{"id":"GHSA-85jh-jp4r-37r3","title":"iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged...","description":"iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection service that runs as root without implementing any authentication or authorization checks.\n\nThis issue affects iBoysoft NTFS: 8.0.0.","status":"published","published":"2026-03-03T15:31:41Z","modified":"2026-04-27T15:30:29Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:07:39.383876Z"}],"nvd":[{"id":"CVE-2026-2637","description":"iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection service that runs as root without implementing any authentication or authorization checks.\n\nThis issue affects iBoysoft NTFS: 8.0.0.","status":"published","published":"2026-03-03T15:16:20.95Z","modified":"2026-06-17T10:31:26.64Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:12:07.420927Z"}]}}