PT-2025-39246 · Magnetism Studios · Endurance

Swayzgl1Tzyyy · CVE-2025-10906 · Published 2025-09-24 · Updated 2025-09-29

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magnetism Studios Endurance versions up to 3.3.0

Description A security issue exists in Magnetism Studios Endurance on macOS. The loadModuleNamed:WithReply function within the file /Applications/Endurance.app/Contents/Library/LaunchServices/com.MagnetismStudios.endurance.helper component, specifically the NSXPC Interface, is susceptible to manipulation that can result in missing authentication. The attack requires local access.

Recommendations Versions prior to 3.3.0 should be updated.

Exploit

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2025-10906

Affected Products

Endurance

References · 12

• 🔥 https://github.com/SwayZGl1tZyyy/n-days/blob/main/Endurance/README.md#proof-of-concept · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10906 · Security Note
• https://github.com/SwayZGl1tZyyy/n-days/blob/main/Endurance/README.md · Note
• https://t.me/CVEtracker/33238 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1970851695186841761 · Twitter Post
• https://vuldb.com/?submit.653994 · Note
• https://vuldb.com/?id.325691 · Note
• https://twitter.com/CveFindCom/status/1970838052432904530 · Twitter Post
• https://vuldb.com/?ctiid.325691 · Note
• https://t.me/cveNotify/136256 · Telegram Post
• https://twitter.com/CVEnew/status/1970848941848567834 · Twitter Post
• https://twitter.com/cracbot/status/1972617406297108523 · Twitter Post