CVE-2026-0924

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0924", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "state": "PUBLISHED", "assignerShortName": "Fluid Attacks", "dateReserved": "2026-01-13T20:47:00.900Z", "datePublished": "2026-02-02T20:18:21.258Z", "dateUpdated": "2026-04-21T02:40:06.930Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "BuhoCleaner", "vendor": "Dr.Buho", "versions": [{"status": "affected", "version": "1.15.2"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dr.buho:buhocleaner:1.15.2:*:macos:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "Oscar Uribe"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "BuhoCleaner&nbsp;contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.<p>This issue affects BuhoCleaner: 1.15.2.</p>"}], "value": "BuhoCleaner\u00a0contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects BuhoCleaner: 1.15.2."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 7.3, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2026-04-20T14:12:27.017Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://fluidattacks.com/advisories/solstafir"}, {"tags": ["product"], "url": "https://www.drbuho.com/buhocleaner"}, {"tags": ["patch"], "url": "https://www.drbuho.com/buhocleaner/download"}], "source": {"discovery": "UNKNOWN"}, "title": "BuhoCleaner 1.15.2 - Local Privilege Escalation via PID reuse attack", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T15:04:46.766238Z", "id": "CVE-2026-0924", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T02:40:06.930Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0924", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-03T15:04:46.766238Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T15:05:00.424Z"}}], "cna": {"title": "BuhoCleaner 1.15.2 - Local Privilege Escalation via PID reuse attack", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Oscar Uribe"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dr.Buho", "product": "BuhoCleaner", "versions": [{"status": "affected", "version": "1.15.2"}], "platforms": ["MacOS"], "defaultStatus": "unaffected"}], "references": [{"url": "https://fluidattacks.com/advisories/solstafir", "tags": ["third-party-advisory"]}, {"url": "https://www.drbuho.com/buhocleaner", "tags": ["product"]}, {"url": "https://www.drbuho.com/buhocleaner/download", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "BuhoCleaner\u00a0contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects BuhoCleaner: 1.15.2.", "supportingMedia": [{"type": "text/html", "value": "BuhoCleaner&nbsp;contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.<p>This issue affects BuhoCleaner: 1.15.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dr.buho:buhocleaner:1.15.2:*:macos:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2026-04-20T14:12:27.017Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0924", "state": "PUBLISHED", "dateUpdated": "2026-04-20T14:12:27.017Z", "dateReserved": "2026-01-13T20:47:00.900Z", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "datePublished": "2026-02-02T20:18:21.258Z", "assignerShortName": "Fluid Attacks"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "BuhoCleaner", "vendor": "Dr.Buho", "versions": [{"status": "affected", "version": "1.15.2"}]}], "source": "help@fluidattacks.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:drbuho:buhocleaner:1.15.2:*:*:*:*:macos:*:*", "matchCriteriaId": "9A2DE65B-B60F-406D-B50E-0B4F4BC91F5F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BuhoCleaner\u00a0contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects BuhoCleaner: 1.15.2."}, {"lang": "es", "value": "BuhoCleaner contiene un servicio XPC inseguro que permite a usuarios locales y sin privilegios escalar sus privilegios a root a trav\u00e9s de funciones inseguras. Este problema afecta a BuhoCleaner: 1.15.2."}], "id": "CVE-2026-0924", "lastModified": "2026-06-17T10:11:38.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "help@fluidattacks.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0924", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T15:04:46.766238Z", "version": "2.0.3"}}]}, "published": "2026-02-02T23:16:03.683", "references": [{"source": "help@fluidattacks.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://fluidattacks.com/advisories/solstafir"}, {"source": "help@fluidattacks.com", "tags": ["Product"], "url": "https://www.drbuho.com/buhocleaner"}, {"source": "help@fluidattacks.com", "tags": ["Product"], "url": "https://www.drbuho.com/buhocleaner/download"}], "sourceIdentifier": "help@fluidattacks.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "help@fluidattacks.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-367"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T18:50:44.904044+00:00", "value": {"mitigation_remediation": ["Install the latest version of BuhoCleaner that includes the fix for the insecure XPC service.", "Restrict the XPC service to only trusted system users and remove unnecessary access for regular accounts.", "Enforce the principle of least privilege by revoking elevated privileges from local user accounts that are not required to run the application."], "summary": {"action": "Patch Now", "impact": "Privilege Escalation to root"}, "threat_synthesis": {"affected_systems": "The affected product is Dr.Buho BuhoCleaner version 1.15.2, running on macOS. Only this specific version is known to be susceptible to the local privilege escalation via PID reuse attack.", "description_and_impact": "BuhoCleaner contains an insecure XPC service that permits a local, unprivileged user to gain root privileges through insecure functions. The flaw involves concurrency weaknesses identified by CWE\u2011367 (Improper Locking). The result is a local privilege escalation that can compromise system integrity, allowing an attacker to execute arbitrary code as root.", "risk_and_exploitability": "The vulnerability has a CVSS score of 7.3, indicating a high impact, while the EPSS score is below 1% showing a very low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker who has access to the same user account on the affected machine can exploit the insecure XPC service through PID reuse to elevate their privileges to root."}}}}, "created": "2026-04-18T00:45:32.232080+00:00", "updated": "2026-04-20T19:00:10.682801+00:00", "vendors": []}