PT-2025-26298 · Postbox · Postbox

Karol Mazurek · Published 2025-06-20 · Updated 2025-06-20 · CVE-2025-5963

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Postbox versions (affected versions not specified)

Description: The Postbox's configuration on macOS allows for Dynamic Library (Dylib) injection due to the presence of certain entitlements. A local attacker with unprivileged access can use environment variables like DYLD INSERT LIBRARIES to inject code in the application's context and bypass Transparency, Consent, and Control (TCC). The acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted permissions requires user interaction with a system prompt asking for permission.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-5963

Affected Products

Postbox

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-5963 · Security Note
• https://cert.pl/en/posts/2025/06/tcc-bypass · Note
• https://t.me/cvenotify/126233 · Telegram Post
• https://postbox-inc.com · Note
• https://t.me/cvetracker/26641 · Telegram Post
• https://twitter.com/CVEnew/status/1936110516038255080 · Twitter Post