PT-2025-22984 · Viscosity · Viscosity

Karol Mazurek · CVE-2025-4412 · Published 2025-05-27 · Updated 2025-05-27

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Viscosity versions prior to 1.11.5

Description The issue allows loading a dynamic library with Viscosity's TCC identity on macOS systems by utilizing a Launch Agent and loading the viscosity openvpn process from the application bundle. The acquired resource access is limited without entitlements such as access to the camera or microphone. Only user-granted permissions for file resources apply. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission.

Recommendations For versions prior to 1.11.5, update to version 1.11.5 to resolve the issue. As a temporary workaround, consider restricting the use of the viscosity openvpn process until the update is applied.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-4412

Affected Products

Viscosity

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-4412 · Security Note
• https://twitter.com/CVEnew/status/1927314640733692260 · Twitter Post
• https://sparklabs.com/viscosity · Note
• https://t.me/cvetracker/24718 · Telegram Post
• https://cert.pl/en/posts/2025/05/tcc-bypass · Note
• https://t.me/cvenotify/123687 · Telegram Post