PT-2025-37917 · Unknown · Sparkle Framework

Karmaz95 · Published 2025-09-16 · Updated 2025-09-16 · CVE-2025-10015

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sparkle framework versions prior to 2.7.2

Description The Sparkle framework includes an XPC service, Downloader.xpc, which is, by default, private to the application it is bundled with. A local, unprivileged attacker can register this XPC service globally, inheriting the application’s TCC permissions. The lack of validation of connecting clients allows the attacker to copy TCC-protected files to an arbitrary location. Access to other resources beyond granted permissions requires user interaction with a system prompt asking for permission.

Recommendations Update to Sparkle framework version 2.7.2 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-10015

Affected Products

Sparkle Framework

References · 7

• https://github.com/sparkle-project/Sparkle/discussions/2764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10015 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10015 · Vendor Advisory
• https://github.com/sparkle-project/Sparkle · Note
• https://cert.pl/en/posts/2025/09/CVE-2025-10015 · Note
• https://t.me/CVEtracker/32618 · Telegram Post
• https://twitter.com/CVEnew/status/1967965152336388386 · Twitter Post