CVEvulnerability

CVE-2026-4556

7.8 HIGH Published 2026-09-28 Modified 2026-09-29 Official page ↗
Status
Awaiting Analysis
Published
2026-09-28
Last modified
2026-09-29
Assigner
41c37e40-543d-43a2-b660-2fee83ea851a
CVSS 3.1 (41c37e40-543d-43a2-b660-2fee83ea851a)
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78

Description

Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC. The [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] method executes a syslog command using attacker-controlled parameters without proper sanitization, enabling command injection. Successful exploitation allows a local attacker to execute arbitrary commands with root privileges through LaunchSynchronous.

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References