{"id":"CVE-2026-2637","state":"PUBLISHED","title":"iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection service that runs as root ","description":"iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection service that runs as root without implementing any authentication or authorization checks.\n\nThis issue affects iBoysoft NTFS: 8.0.0.","publishedAt":"2026-03-03T14:04:28.459Z","updatedAt":"2026-03-03T14:35:43.673Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"Fluid Attacks"},"assigner":"Fluid Attacks","products":["iBoysoft iBoysoft NTFS"],"affected":[{"vendor":"iBoysoft","product":"iBoysoft NTFS","defaultStatus":"unaffected","versions":[{"version":"8.0.0","status":"affected"}],"platforms":["MacOS"]}],"references":["https://fluidattacks.com/advisories/cuarteto","https://iboysoft.com/ntfs-for-mac/"],"weaknesses":["CWE-732"],"ingestedAt":"2026-10-29T20:11:31.369Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/2xxx/CVE-2026-2637.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-2637","state":"PUBLISHED","datePublished":"2026-03-03T14:04:28.459Z","dateUpdated":"2026-03-03T14:35:43.673Z","assignerShortName":"Fluid Attacks","assignerOrgId":"84fe0718-d6bb-4716-a7e8-81a6d1daa869","dateReserved":"2026-02-17T19:10:25.606Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"iBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes an NSConnection service that runs as root without implementing any authentication or authorization checks.\n\nThis issue affects iBoysoft NTFS: 8.0.0."}],"affected":[{"vendor":"iBoysoft","product":"iBoysoft NTFS","defaultStatus":"unaffected","versions":[{"version":"8.0.0","status":"affected"}],"platforms":["MacOS"]}],"references":[{"url":"https://fluidattacks.com/advisories/cuarteto","tags":["third-party-advisory"]},{"url":"https://iboysoft.com/ntfs-for-mac/","tags":["product"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.5,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-732","description":"CWE-732 Incorrect Permission Assignment for Critical Resource","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Fluid Attacks","orgId":"84fe0718-d6bb-4716-a7e8-81a6d1daa869","dateUpdated":"2026-03-03T14:04:28.459Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:iboysoft:iboysoft_ntfs:8.0.0:*:macos:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Oscar Uribe"}],"impacts":[{"capecId":"CAPEC-233","descriptions":[{"lang":"en","value":"CAPEC-233 Privilege Escalation"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-03T14:35:28.831057Z","id":"CVE-2026-2637","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-03T14:35:43.673Z"}}]}}}