CVE‑2026‑112445: How a Mis‑configured macOS LaunchDaemon Lets Any User Gain Root

What the vulnerability is

A new macOS privilege‑escalation bug, catalogued as CVE‑2026‑112445, stems from the launch daemon com.apple.xpc.uscwoap. The daemon lives in */System/Library/LaunchDaemons* and is configured to run Bash as root with its standard input attached to /dev/console.

How it works (confirmed details)

• The launchd job belongs to the system domain and does not specify a non‑privileged user account; therefore the Bash process starts with UID 0.
• The `StandardInPath` key points to */dev/console*, which in a graphical login session is owned by the currently logged‑in (non‑admin) user.
• Any user who can access the console can start the job via launchd’s job‑control interface without needing admin credentials.
• Once running, the root Bash reads commands directly from */dev/console*.
• The terminal ioctl TIOCSTI allows a process to inject characters into the input queue of the console device. An unprivileged process owned by the logged‑in user can call TIOCSTI, place arbitrary text into */dev/console*, and the root Bash will execute it as a command.
• No authorization check is performed on the process that supplies the characters, so the privilege boundary is effectively bypassed.

Reported claims and unknowns

• Apple assigned CVE‑2026‑112445 to the issue, but the identifier does not appear in the public security advisory. The reason for this omission is unknown.
• The vulnerability is present in macOS builds up to 27.1. Apple removed the offending launch daemon configuration in macOS 27.2.

Practical implications

• A non‑admin user who can log into the graphical console can obtain a root shell, potentially compromising the entire system.
• Attackers could automate the injection using a small helper program that calls TIOCSTI, making the exploit trivial to script.

How to verify if you are affected

1. Open Terminal and run:

``` sudo launchctl list | grep uscwoap ``` If the job appears, the system is likely vulnerable.

2. Check the launch daemon file:

``` cat /System/Library/LaunchDaemons/com.apple.xpc.uscwoap.plist ``` Look for `BootShell` set to true and `StandardInPath` pointing to `/dev/console`.

3. Verify your macOS version (`System Settings → About This Mac`). Versions 27.2 or later have the configuration removed.

Mitigation steps

• Update to macOS 27.2 or later, which deletes the launch daemon.
• If updating is not possible, manually unload and delete the plist:

``` sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.xpc.uscwoap.plist sudo rm /System/Library/LaunchDaemons/com.apple.xpc.uscwoap.plist ```

• Restrict console access to trusted administrators only.
• Monitor for unexpected root processes that originate from `/dev/console`.

Bottom line

CVE‑2026‑112445 demonstrates how a seemingly innocuous launch‑daemon configuration can turn a regular user into a root attacker. Updating macOS or removing the daemon eliminates the risk.